184ebb43bfbace5e61336e001253872960b03af82d2082c84500eb68a5328e07

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FREEBOTNET.exe
Size 2.1MB
Sample260626-s8ddpsds2m
SHA256 184ebb43bfbace5e61336e001253872960b03af82d2082c84500eb68a5328e07
MD5 891a0b15abf0b64496ab43d6c8d8d6dd
SHA1 21cb4e2dfd96f5ebc86dbe40f227a8b1a61e5235
SHA512 b47cb6c67fb7e90abea85bbce12a60f73ad6720a5db4b96091bd62ab34cd9c33112397be1c2f9392b8450abdbafed488076b5d4352621ec6b5fab4f0c065fe26
SSDEEP 49152:Hkwzj39pva3/Ioj15e4w8xhACEKzs57Xci5NLd:fojPJw80Rp7XcO1
TLSH
T1DDA5CF17A76801FDD0A3D2BACE524807E7B1B8460771A7DF03D09AA61F176D89E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4892	powershell.exe
7	5048	powershell.exe
8	4504	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4724	powershell.exe
2536	powershell.exe
4892	powershell.exe
5048	powershell.exe
4504	powershell.exe
912	powershell.exe
1700	powershell.exe
2984	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
4564	SystemServices.exe
4344	helper_4564.exe
4308	SystemServices.exe
2392	helper_4308.exe
4452	helper_4308.exe
1472	helper_2028.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemServices.exe\" --silent"	FREEBOTNET.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SystemServices.exe\" --silent"	SystemServices.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
31	api.gofile.io
32	discord.com
34	discord.com
11	api.gofile.io
12	api.gofile.io
30	discord.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
7	api.ipify.org
8	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3016	cmd.exe
2724	netsh.exe
3976	cmd.exe
1184	netsh.exe
1180	cmd.exe
3236	netsh.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2608	WMIC.exe
3940	WMIC.exe

Kills process with taskkill 14 IoCs

defense_evasion

pid	Process
3032	taskkill.exe
1204	taskkill.exe
4060	taskkill.exe
2572	taskkill.exe
5084	taskkill.exe
2460	taskkill.exe
2444	taskkill.exe
2572	taskkill.exe
3996	taskkill.exe
2432	taskkill.exe
2404	taskkill.exe
4060	taskkill.exe
4340	taskkill.exe
4724	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3784	schtasks.exe
4532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
912	powershell.exe
4892	powershell.exe
912	powershell.exe
4892	powershell.exe
4564	SystemServices.exe
4564	SystemServices.exe
5048	powershell.exe
5048	powershell.exe
1700	powershell.exe
1700	powershell.exe
5048	powershell.exe
1700	powershell.exe
1700	powershell.exe
2984	powershell.exe
2984	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
2984	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
2536	powershell.exe
2536	powershell.exe
2536	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	powershell.exe
Token: SeDebugPrivilege	2444	taskkill.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	4340	taskkill.exe
Token: SeDebugPrivilege	5048	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	2984	powershell.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	3032	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeDebugPrivilege	3996	taskkill.exe
Token: SeDebugPrivilege	1204	taskkill.exe
Token: SeDebugPrivilege	4060	taskkill.exe
Token: SeDebugPrivilege	2432	taskkill.exe
Token: SeDebugPrivilege	2404	taskkill.exe
Token: SeDebugPrivilege	2572	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3940	WMIC.exe
Token: SeSecurityPrivilege	3940	WMIC.exe
Token: SeTakeOwnershipPrivilege	3940	WMIC.exe
Token: SeLoadDriverPrivilege	3940	WMIC.exe
Token: SeSystemProfilePrivilege	3940	WMIC.exe
Token: SeSystemtimePrivilege	3940	WMIC.exe
Token: SeProfSingleProcessPrivilege	3940	WMIC.exe
Token: SeIncBasePriorityPrivilege	3940	WMIC.exe
Token: SeCreatePagefilePrivilege	3940	WMIC.exe
Token: SeBackupPrivilege	3940	WMIC.exe
Token: SeRestorePrivilege	3940	WMIC.exe
Token: SeShutdownPrivilege	3940	WMIC.exe
Token: SeDebugPrivilege	3940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3940	WMIC.exe
Token: SeRemoteShutdownPrivilege	3940	WMIC.exe
Token: SeUndockPrivilege	3940	WMIC.exe
Token: SeManageVolumePrivilege	3940	WMIC.exe
Token: 33	3940	WMIC.exe
Token: 34	3940	WMIC.exe
Token: 35	3940	WMIC.exe
Token: 36	3940	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3940	WMIC.exe
Token: SeSecurityPrivilege	3940	WMIC.exe
Token: SeTakeOwnershipPrivilege	3940	WMIC.exe
Token: SeLoadDriverPrivilege	3940	WMIC.exe
Token: SeSystemProfilePrivilege	3940	WMIC.exe
Token: SeSystemtimePrivilege	3940	WMIC.exe
Token: SeProfSingleProcessPrivilege	3940	WMIC.exe
Token: SeIncBasePriorityPrivilege	3940	WMIC.exe
Token: SeCreatePagefilePrivilege	3940	WMIC.exe
Token: SeBackupPrivilege	3940	WMIC.exe
Token: SeRestorePrivilege	3940	WMIC.exe
Token: SeShutdownPrivilege	3940	WMIC.exe
Token: SeDebugPrivilege	3940	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3940	WMIC.exe
Token: SeRemoteShutdownPrivilege	3940	WMIC.exe
Token: SeUndockPrivilege	3940	WMIC.exe
Token: SeManageVolumePrivilege	3940	WMIC.exe
Token: 33	3940	WMIC.exe
Token: 34	3940	WMIC.exe
Token: 35	3940	WMIC.exe
Token: 36	3940	WMIC.exe
Token: SeDebugPrivilege	5084	taskkill.exe
Token: SeDebugPrivilege	2460	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3816	WMIC.exe
Token: SeSecurityPrivilege	3816	WMIC.exe
Token: SeTakeOwnershipPrivilege	3816	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 3796	2028	FREEBOTNET.exe	88
PID 2028 wrote to memory of 3828	2028	FREEBOTNET.exe	89
PID 2028 wrote to memory of 768	2028	FREEBOTNET.exe	90
PID 2028 wrote to memory of 3016	2028	FREEBOTNET.exe	94
PID 2028 wrote to memory of 4540	2028	FREEBOTNET.exe	95
PID 3796 wrote to memory of 3784	3796	cmd.exe	97
PID 3828 wrote to memory of 4892	3828	cmd.exe	99
PID 2028 wrote to memory of 912	2028	FREEBOTNET.exe	100
PID 3016 wrote to memory of 2724	3016	cmd.exe	146
PID 768 wrote to memory of 2444	768	cmd.exe	103
PID 4564 wrote to memory of 4480	4564	SystemServices.exe	108
PID 4564 wrote to memory of 4372	4564	SystemServices.exe	110
PID 4564 wrote to memory of 4344	4564	SystemServices.exe	111
PID 4564 wrote to memory of 3976	4564	SystemServices.exe	112
PID 4564 wrote to memory of 1700	4564	SystemServices.exe	116
PID 4480 wrote to memory of 5048	4480	cmd.exe	119
PID 4372 wrote to memory of 4340	4372	cmd.exe	120
PID 3976 wrote to memory of 1184	3976	cmd.exe	123
PID 2028 wrote to memory of 4644	2028	FREEBOTNET.exe	124
PID 4308 wrote to memory of 4984	4308	SystemServices.exe	127
PID 4308 wrote to memory of 2408	4308	SystemServices.exe	128
PID 4308 wrote to memory of 3676	4308	SystemServices.exe	129
PID 4308 wrote to memory of 1180	4308	SystemServices.exe	130
PID 4308 wrote to memory of 2392	4308	SystemServices.exe	131
PID 4308 wrote to memory of 2984	4308	SystemServices.exe	132
PID 4344 wrote to memory of 2196	4344	helper_4564.exe	139
PID 4344 wrote to memory of 2196	4344	helper_4564.exe	139
PID 1180 wrote to memory of 3236	1180	cmd.exe	140
PID 4564 wrote to memory of 1596	4564	SystemServices.exe	142
PID 2408 wrote to memory of 4504	2408	cmd.exe	144
PID 3676 wrote to memory of 4724	3676	cmd.exe	210
PID 4644 wrote to memory of 3032	4644	cmd.exe	147
PID 4984 wrote to memory of 4532	4984	cmd.exe	160
PID 1596 wrote to memory of 2572	1596	cmd.exe	169
PID 4308 wrote to memory of 2696	4308	SystemServices.exe	150
PID 2028 wrote to memory of 2300	2028	FREEBOTNET.exe	152
PID 2696 wrote to memory of 3996	2696	cmd.exe	154
PID 2300 wrote to memory of 1204	2300	cmd.exe	175
PID 4308 wrote to memory of 3804	4308	SystemServices.exe	156
PID 3804 wrote to memory of 4060	3804	cmd.exe	184
PID 2028 wrote to memory of 2144	2028	FREEBOTNET.exe	159
PID 2144 wrote to memory of 2432	2144	cmd.exe	161
PID 4308 wrote to memory of 1952	4308	SystemServices.exe	162
PID 2028 wrote to memory of 4272	2028	FREEBOTNET.exe	164
PID 1952 wrote to memory of 2404	1952	cmd.exe	193
PID 4308 wrote to memory of 4288	4308	SystemServices.exe	167
PID 4272 wrote to memory of 2572	4272	cmd.exe	169
PID 2392 wrote to memory of 2452	2392	helper_4308.exe	170
PID 2392 wrote to memory of 2452	2392	helper_4308.exe	170
PID 4288 wrote to memory of 3940	4288	cmd.exe	171
PID 4308 wrote to memory of 3384	4308	SystemServices.exe	172
PID 4344 wrote to memory of 780	4344	helper_4564.exe	212
PID 4344 wrote to memory of 780	4344	helper_4564.exe	212
PID 2028 wrote to memory of 1204	2028	FREEBOTNET.exe	175
PID 3384 wrote to memory of 5084	3384	cmd.exe	223
PID 4308 wrote to memory of 1736	4308	SystemServices.exe	178
PID 1204 wrote to memory of 2460	1204	cmd.exe	180
PID 1736 wrote to memory of 3816	1736	cmd.exe	181
PID 4308 wrote to memory of 540	4308	SystemServices.exe	182
PID 540 wrote to memory of 4060	540	cmd.exe	184
PID 4308 wrote to memory of 3068	4308	SystemServices.exe	185
PID 3068 wrote to memory of 2680	3068	cmd.exe	187
PID 2392 wrote to memory of 3780	2392	helper_4308.exe	188
PID 2392 wrote to memory of 3780	2392	helper_4308.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\FREEBOTNET.exe
"C:\Users\Admin\AppData\Local\Temp\FREEBOTNET.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsSystemUpdater" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe\" --silent" /sc MINUTE /mo 30 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsSystemUpdater" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe\" --silent" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:768
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\ce_2028"
  2⤵
  PID:4540
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\grabbed_2028\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\GrabbedFiles_2028.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im brave.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im msedge.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im opera.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4532
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im browser.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /f /im vivaldi.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vivaldi.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2460
- C:\Users\Admin\AppData\Local\Temp\helper_2028.exe
  "C:\Users\Admin\AppData\Local\Temp\helper_2028.exe" --kill --output-path "C:\Users\Admin\AppData\Local\Temp\ce_2028" all
  2⤵
  - Executes dropped EXE
  PID:1472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2852
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\grabbed_2028"
  2⤵
  PID:2604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\ce_2028"
  2⤵
  PID:404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  PID:780
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic os get Caption
  2⤵
  PID:4384
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Caption
    3⤵
    PID:4492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic cpu get name
  2⤵
  PID:1000
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:4116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c move /y "C:\Users\Admin\AppData\Local\Temp\sess_2028" "C:\Users\Admin\AppData\Local\Temp\Scanned_2028\Games\Steam_Riot" >nul 2>&1
  2⤵
  PID:3888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Scanned_2028\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\VictusData_2028.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\Scanned_2028"
  2⤵
  PID:4932

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe" --silent
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\Users\Admin\AppData\Local\Temp\helper_4564.exe
  "C:\Users\Admin\AppData\Local\Temp\helper_4564.exe" --kill --output-path "C:\Users\Admin\AppData\Local\Temp\ce_4564" all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:780
- C:\Windows\system32\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\grabbed_4564\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\GrabbedFiles_4564.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im brave.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2572

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\system32\cmd.exe
  cmd.exe /c schtasks /create /tn "WindowsSystemUpdater" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe\" --silent" /sc MINUTE /mo 30 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "WindowsSystemUpdater" /tr "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe\" --silent" /sc MINUTE /mo 30 /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- C:\Windows\system32\cmd.exe
  cmd.exe /c powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Invoke-WebRequest -Uri 'https://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\Windows\system32\cmd.exe
  cmd.exe /c netsh wlan show profiles
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3236
- C:\Users\Admin\AppData\Local\Temp\helper_4308.exe
  "C:\Users\Admin\AppData\Local\Temp\helper_4308.exe" --kill --output-path "C:\Users\Admin\AppData\Local\Temp\ce_4308" all
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\grabbed_4308\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\GrabbedFiles_4308.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im brave.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3996
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im msedge.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4060
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im opera.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2404
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im browser.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im browser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic os get Caption
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /f /im vivaldi.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:4060
- C:\Windows\system32\cmd.exe
  cmd.exe /c wmic cpu get name
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get name
    3⤵
    PID:2680
- C:\Windows\system32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\ce_4308"
  2⤵
  PID:4088
- C:\Users\Admin\AppData\Local\Temp\helper_4308.exe
  "C:\Users\Admin\AppData\Local\Temp\helper_4308.exe" --kill --output-path "C:\Users\Admin\AppData\Local\Temp\ce_4308" all
  2⤵
  - Executes dropped EXE
  PID:4452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4208
- C:\Windows\system32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\grabbed_4308"
  2⤵
  PID:2280
- C:\Windows\system32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\ce_4308"
  2⤵
  PID:4140
- C:\Windows\system32\cmd.exe
  cmd.exe /c move /y "C:\Users\Admin\AppData\Local\Temp\sess_4308" "C:\Users\Admin\AppData\Local\Temp\Scanned_4308\Games\Steam_Riot" >nul 2>&1
  2⤵
  PID:4084
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\Scanned_4308\*' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\VictusData_4308.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Windows\system32\cmd.exe
  cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\Scanned_4308"
  2⤵
  PID:2240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2724

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 1171fdbddc27e69e7e71b60a129af696 RAuLff6ZJEiwgXIS9sASFA.0.1.0.0.0
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
TLSH
T15F51EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 12ca7ec444412faa690feee53e69fe8d92678a2a66e02b868b62a84161ebf9d7
MD5 8cd7f1691eabd93237298feb8517b4e8
SHA1 f25919b143b84465b81fdc4e1fdf8839b6c162f5
SHA512 569480febcec040ff525901dbad9cf71b9a54b377d550e38ff9409aee7ba6bf3fa249b14fe4eabdc39b2d2e9e1600ba7ba5447dbffcfa97a7a6e651df19181ea
TLSH
T153117637B39CCA21CC96153A409DAC1172B683C781AEDF9FBBC4D615A0BF584CB712A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 326ca9962c02f607cad072f5a8ec6cb894cbf9e9f50f21f1830b6719c063586f
MD5 e6ce6b8b25038eb4d729d9fd01738586
SHA1 eb5dd0b16c5810025f7eaf85ce996af8f90b1aab
SHA512 b0b7c34278a5183c6ef359b77f2315b2433a9db1c30c31a5202a73243b52552255b0182d9f0c2c198e701c83e4c5c2d8c10a468aa6b4b23caf68869904034d01
TLSH
T1E231EB27B39C89E1CC85053A409D9C2037B692D381DECFDBBBC4E604A0BF598CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 922e02b844d68808d3d0e17a4dc4874cb15dbd2acadef7c933891f57071356e8
MD5 331b992e0f1b6002a5d3c0efd7f969cf
SHA1 b4521fd1345ed3ed68ed8e8dde17c71e3cc8a03d
SHA512 b390ad2e1e024dfaedd6d604b11e1d887f8883641175a5bddc4b36a69cf11b0f5a84ab5924fd4839ecc0494525e300ff4bbe249b9e54da9572fc19c235b57205
TLSH
T12531EB37B39C89E1CC85053A409D9C2036B692D351DECFDBBBC4E604A0BF598CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6ee3b7bca4e448296991a710bbf01038696b9f2a2174aed31ecaf900f8d6c822
MD5 a96a8d771ed21f326b064bf83643c43b
SHA1 967ce71f7ef10ff8c407724ad378b371a7126c84
SHA512 7b1cc91ae39d96a8389985c04e64d323689b15e972c05b3c6c37f39bb86389158c2e5373b2c7a117e82e78f5294208803c087d09622895a74dcd1f0cd88e05df
TLSH
T1BC31C927B39C89E1CC85053A419D9C2076B692D341DECFDBBBC4E604A0BF598CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

GrabbedFiles_4308.zip

Path C:\Users\Admin\AppData\Local\Temp\GrabbedFiles_4308.zip
Size 3.5MB
SHA256 a1353f2be84b210a006d0eaaf24dd5323b65f83c2c13fe3498ce9ec555bde307
MD5 89b353f8a849dbade0f954f26191618d
SHA1 75b52d627c73558529efc29e86fbd732ffb38faf
SHA512 8725ed2f5135f1ab250d6638aa62ebcecc8a9aa197bd1c434a67fcead63f3899058019c0ae745b92e25e1ca0405ef7f6acbb40ea44eb7eb353e6747c901a7c99
SSDEEP 98304:UBwh+8i/LXyjRzdVuIVCv0w/G6adQk/Pg2yyoEZkccsyk:OGi/LC1rY0w/G6adF/Zyyosksyk
TLSH
T14D0633E78E156B96C2C85BEACF107613D0DB7E285FA16785472E5F3396C0387B1A0A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zctyrbxx.zew.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zctyrbxx.zew.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cookies.json

Path C:\Users\Admin\AppData\Local\Temp\ce_4308\Chrome\Default\cookies.json
Size 339B
SHA256 6f875b968afebb71ce5ad91fc257eece437803664c0d30a9cf14ed411cc67ed7
MD5 ffa791e9f0c929f6294fb41eec1e0503
SHA1 161020a5f89e1f47a47aa63cf92e2a618b051fe9
SHA512 d3cc8ce7a09bc125aff86ac73d571227c3412b758392eb19f7a7713be45841a96b95228406d7d248db68590ba9b8610c777aba21e111cafb4c648408e49a17ff
TLSH
T107E02D67889A3E12C43746EB1D14198EBF266B8BE13FEECAC0368A00769480B6521083
MD5 SHA1 SHA512 TLSH

Submit Download

ApproveRead.xlsx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_2028\ApproveRead.xlsx
Size 10KB
SHA256 c157c9afca41b88ccd84cf616e583d1186bb77da8620a142e9c4b6517798a33a
MD5 c8d29e662d1c9385e3e0069596f7f0b7
SHA1 c50df19adad1c4602ef21ead724c988337ab1d27
SHA512 ef9d67344027e1a637711a3962250ce18431b33b31f13fbe51f1becd30ef68f6429c512497a4ca905360b77658e4dffb93bcec7ac6a15fa61178a0a570437d52
SSDEEP 192:wc8mVRD4wibb3UkgVIpnEHoaFUlbVvevUqzQXpS086cdPTt2gz7faovBc:wc3bDBi33PgVonmlUlM9z6pkBrttfaoS
TLSH
T153328E85A168D43AC6B3447C828B01D5F28DA180D685648F6421F26F77C51AE67EE2FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlockRevoke.docx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_2028\BlockRevoke.docx
Size 661KB
SHA256 829cb8036df3531576d9e4fc26231c3dc248817801f383b148779f78c12b24fd
MD5 77e2f7b85b0f44763f6a58a284506175
SHA1 2624289b11d4784e4d8498717d8a08efdf2220a6
SHA512 fd2d8f4a21970d02af21b1a7986efe73c77b0aafd503f50e1ed68a35e1b68f7b3778788274fd1c3e6df3d2e012e7ad11b8b0c77449ea5406aa76285d620d9e96
SSDEEP 12288:XdWITur0guGPRhGhp4NawZVfDlnvm1KMi+PGkw0WkbirpkRiA2ycIooI4xanhsWZ:trTuzuGJAh7wDD9DMiARWkbirpw9aNb1
TLSH
T108E423D30D05EBBAC6CC076E976D2297655DAF390EF086CAF058BB2ED19424BD5C4328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseSearch.docx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_2028\CloseSearch.docx
Size 18KB
SHA256 0c77e3e4e6f23579e46fa9c0956a5f44520ddc681238c677d84295a0debbaea7
MD5 dda67ddbbaccf91337652753a5fa5f91
SHA1 7b986de49fa57289474d496e69394bac1dc6e5fe
SHA512 9ae7d6c21b0efffdffb00bc9bede915b39ec3f5c9de66f31037d20c52f854f83c1d16607c213a232193be87c01a0b242d5f71554023a504c826b7c954eff0461
SSDEEP 384:asHP1WUeywuIVoCFbTrjdNxt/ZtNN/n34KcIFHw12N:VvJy9rzxllNP3JcItcy
TLSH
T1A082C03DD644A070EE938D34601F22F9F25A57037C83E48F26DAB78E125AA871757D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompareInvoke.txt

Path C:\Users\Admin\AppData\Local\Temp\grabbed_2028\CompareInvoke.txt
Size 785KB
SHA256 54325a240289783a6f8361b407254cf9e922cfe904cd226626217f59999ea900
MD5 c81ba585869b2d3cf4542d0121f59341
SHA1 3d4e37e0c3014cf361076684cb72a46ed64f78f1
SHA512 681ca7d1a7f9d34b2145575b99b910b3a1b2779d2fee6c0124eff1d77acfe229ea1fb5f437e1852d10cbd0a7d1c0223a240c24986eeefb06fc4dcf5636c19b6e
SSDEEP 24576:pV/LNkAEFCMt40RekTpUxCbvFX4I8sXqUf:pVL7EFCs40RDpyCbvFoIr1f
TLSH
T15A0523F769BC1193E26827E38B247C3298CB2A5C42175396499AFFF35CA73CB2503521
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindCopy.docx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_2028\FindCopy.docx
Size 12KB
SHA256 b9335adfba8d4803240a2a50eedb9cbf82a2dc983d6a70d4e57458b2837b2d1a
MD5 c57822b6452c092228a9d92aa4c84852
SHA1 45015d7e18dc8a2858805c3e88318f5332cb48fa
SHA512 7d4f2946f37c3a1d56dc28bea0e7d5095416d27c043dc9e080616607eef8ab6d9afb5fb04ff7b71c5505be2cf87ff9a00a05af2be939c58cd57f99e21e1c9f38
SSDEEP 192:Ct3PkKN+OV+CCNxtpgoZ22NNyjDcxyreTWNGFHBEADvNMY5:a3Pk+AdNxt/ZtNNyMxIIFHvDlMY5
TLSH
T1C542AF79D9816C50E3E34538901A12FAF54842427F06D45B31E9BFDE82767D22B1BE8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportDismount.xlsx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_2028\ImportDismount.xlsx
Size 14KB
SHA256 2add52cdebc99fbc5f055c35e4d96d42abb9ea1278c87246e46b68abd6ca6758
MD5 3e21864b65830970c6247b81b3d6d43d
SHA1 5b3dacdfba3f78fb48224ad91883c48127e9480e
SHA512 449c5a1f8d65b1d49734e8f223c1b232a52da98856eaead06318488a86f6977a0e026dc943b2295b3b5ddcb03caf6e37b466addfa79ae038bab243ece35086f4
SSDEEP 384:wc3i198203/3rmUlM9z6pmke4ziIJENaoB:wxr23yxWpHvzlJUfB
TLSH
T1F8628D59F922417ACA69C8BE858E14E3F51CA0A0D619244D64E6F2DF1B831CF43EF2C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetRestore.docx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_2028\ResetRestore.docx
Size 489KB
SHA256 d9c87350fd61484bc84ea90152c564790cd91a878ed132a4b13edd2cdcc6c802
MD5 d2d221775ae0e3571b60af355a080a6c
SHA1 c3c8661485b49f84c76985a56f72faefade21ba9
SHA512 cb0a362e60e3e033cfe832fa48ac06cf42626fdd533ec42f4a4b0eab3fd8c01cbc50875f78e46b3bd78b474b5649cede6b5218fbe27499aea89760061abf219d
SSDEEP 12288:yn/EX5Y8K9Iiy+YSSf2iSZP8s9nvxKs5p4GeZT:ygbiy+YSSRsvtHpkT
TLSH
T1B3B42388EB93E36291DF8249CEE6DE12C4557D59FF70998207F7CA0003E929176EC978
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelectReset.xlsx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_2028\SelectReset.xlsx
Size 11KB
SHA256 1ae11fa3f508541794c8423d23c5a1c504b9aed34490f8e232643e894acd8b67
MD5 7a446d39d392e995ff851fe41e480c47
SHA1 8369b9d1b0bfd4a59d07938e98345c139a651f41
SHA512 52b96d77a52384c1fd321bd00e9e4b2ec67088f061adad08d37e71adee3929769e1b0855b628521905b60557e8845ea98041d2a0cf6ed57daddc8cb642df0a80
SSDEEP 192:wc8mVGcb3UskkGObX0fOsWdDaFUlbVvevUqzQXpS0WyN9V47dPN2+ujP9aoDi:wc34E3+dmsWdwUlM9z6plN9WRl2vjP9W
TLSH
T121329E95F4A0697DC2B3847E909B40E0F65C82D04B8736C8F964B46B26613A753DF1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PublishRepair.csv

Path C:\Users\Admin\AppData\Local\Temp\grabbed_4308\PublishRepair.csv
Size 287KB
SHA256 83fcf170b7700781149219fb2d6019b9ec9a8189e4c5f2c7607e15ce71194fd1
MD5 62ac262337c54fd5b31c7c3058ed3e9f
SHA1 3987d46a6df51b0dde16afe22883932ba056fd14
SHA512 bab63fb0383fe08a9d8887c848d01458ca84430ab552675e19a9cb05c97e4538cca8b5bac2b555b80427b19716ad2cc7a2c32e47d8b9e9901d8cb85c5c266522
SSDEEP 6144:btBOit86/ZOKAdu2YsuqFTCcsoBB1ngfkI4cV+3oW6WeY1PXtVSGRNAW9i:JBOie28u2Fio1nBj1PpNXs
TLSH
T1855423BECF1A491C62F6DC288E55F6071A809D9AED4D2A8307B73F30914F6B1E774852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairClear.pdf

Path C:\Users\Admin\AppData\Local\Temp\grabbed_4308\RepairClear.pdf
Size 929KB
SHA256 a9a4a8b34eb31d8f5e321f9626cb14da20ba49eec60b287f0296f9159f42a685
MD5 0d322e32f77d92d15b9c65e093c28c89
SHA1 1272af6ead41c73e3a0dfc775ddbbe63c558e9a0
SHA512 656ce6ce6376cb7a561cd25ee5300b474a9496058a78ccab5aad75f4ae73d11bd6cb9d58304dbd01c0768e7144ae87f79251ab50d9befef890620cc11377e28d
SSDEEP 24576:FoHsT1N73rV5H4TZsek5h22baFPCQE2I1A0kXpp8B:1T1R3aZseb2OVCQ5I1A0k5uB
TLSH
T1601533CAAE150F48C281EBC45D103A9763FEBE519A673BF0C72E062B7EE1705B0599C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MergeUnregister.sql

Path C:\Users\Admin\AppData\Local\Temp\grabbed_4564\MergeUnregister.sql
Size 320KB
SHA256 a62b97db368311348c05590115e2683dae51434f99cca1e4d6a17b66256f4245
MD5 64b760e6b78a783127e59f0994cba639
SHA1 5a21259ec1000d4c7887a0a2fe3d95117dde0bd6
SHA512 c8dfa6eb8c81a15b0dee044a2b62efff749dc3778b4a861d54483523d624aa82353072e1e919b8a80705d1de47549dbffcb0d80686e9c3e5f6ddf7993854948c
SSDEEP 6144:KJa1vV26pNP+9oDA5qABNSI6Vng88fAODvQrClZd/NET4bf6xiQPiH9:KJuvH3+9v5HBNSPg88fAODSClZ1aTcC8
TLSH
T1D96423724412F3674C3FB5E69D10C387B26325EA3B86B7293E2784B35256F11B9A1F24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopMount.xlsx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_4564\PopMount.xlsx
Size 11KB
SHA256 b4a21ee3ef7e8e1f4a86a34c56f83ac97c15068da5be9ed3824cd2a8f2d6967c
MD5 31e8952b1685cedc8f4b5c74a3839d88
SHA1 26531ad4066833f4d5de02426d3dcc881bda09ac
SHA512 78599c6191f87c01cb68b1fbad53c7f173fb0f2d8b0efd4b9ea33199a2065715a938601c4df3cd5941522baf15cdeb5361f9216f20f1b996f8b27140d85e212c
SSDEEP 192:wc8mV9ESHZ+oYxjb3Ul08u5KTTnraFUlbVvevUqzQXpS0zLN1kh27WeIkuaoUHi:wc3vP5No/3oc5qEUlM9z6prLIh27W6uj
TLSH
T19A329D56E1284498CB3B89BC818E05E1759920C08B41F78D3861FAEF63D27B713DB1DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoSplit.docx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_4564\UndoSplit.docx
Size 17KB
SHA256 3ff198a5c47121dc54a49eb652fc7c046bec0cb52d2394c2bd1f2409e2a71798
MD5 20ac852f53e19f9927634ea404a3478a
SHA1 b1421d3a3deb3b5f10de5c1b31601b315feb0b6a
SHA512 1d95dbe0448eb3715210777bf2062be0c3187c785752b3fcc565e407ef8f79923efc35d139d4b24e052d0837bda5035d78fc8bf004b4617a593b2fc78e5eb900
SSDEEP 384:apMLPQ9YgysZY2pCB5QCLCOH1bdNxt/ZtNN6x6IFHU8OVL:vU9nysvg19BxllNxItmR
TLSH
T1AF82AF38E3052870DAE386B8A54D11F1F92C50527A57E45271C97B6F877AB13233F98B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WatchSave.docx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_4564\WatchSave.docx
Size 18KB
SHA256 b4faa0de77958863cb480976f42d0d3161fc957f1bb7ab555fcebafe38cc6c0f
MD5 1619fe00815015b2c137f5953775659f
SHA1 9ae1a6f6d0abde790697f3c436c260308fca7918
SHA512 27b849c37d32eec5c5038bc8ea73333f51fed7c83e80e2344cfd7a25028bc946fef9ba14d88926aa38a4199f44f11716dc338c08282f81f9eb60f7225d087174
SSDEEP 384:a5tnSsCjVzPiKl8CJBQKuGDksXndNxt/ZtNNdtILIFH/HaA:VRzPiKaCrQKuSkG/xllN8ItPz
TLSH
T16382C13DE909E860F2B20D7CD1F123F7B52D02127B06E46A317ADBDF5293B1A5B02595
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WriteClear.xlsx

Path C:\Users\Admin\AppData\Local\Temp\grabbed_4564\WriteClear.xlsx
Size 10KB
SHA256 3eb9d20b98ffb44ca774f9469420d8cfeb4aa34bb94bb549ec89b42511eb064b
MD5 59575e72b981f29f757970f0feb5a146
SHA1 bc40fed7cb1c8e5422e42af72594ab78898dde1c
SHA512 fc2e28e3e321e1420bd97e813cf3ee5f313841b936f1d0cd5ae47df4dff24e0ce77f40710f560bd09ae187887b0b21484b160e59ba14dfeae7d6d114b2f06154
SSDEEP 192:wc8mVcuk9cfaOEb3UdEGSYflR2czaFUlbVvevUqzQXpS058HsNaoZ1:wc3SxcSz3A92NUlM9z6pCHgaoZ1
TLSH
T125329D99D66148ADC257887EE0CE01D1F68EA0C05E863A877874F79E168029713DF2FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper_4564.exe

Path C:\Users\Admin\AppData\Local\Temp\helper_4564.exe
Size 1.4MB
SHA256 e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690
MD5 1d04536714bb22a3e909525a7dd627f0
SHA1 affc166fa1874ff3ec0e42646e008cec972b76ab
SHA512 ec2028983c8c5939545c572f13e1d24e730ca1601c6a8840769d1a6b28b8e12d7c9bd1850007ec0be8abc7c44e12bafcd64dc5b4c842155b75a70d8c71769166
SSDEEP 24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd
TLSH
T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemServices.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemServices.exe
Size 2.1MB
SHA256 184ebb43bfbace5e61336e001253872960b03af82d2082c84500eb68a5328e07
MD5 891a0b15abf0b64496ab43d6c8d8d6dd
SHA1 21cb4e2dfd96f5ebc86dbe40f227a8b1a61e5235
SHA512 b47cb6c67fb7e90abea85bbce12a60f73ad6720a5db4b96091bd62ab34cd9c33112397be1c2f9392b8450abdbafed488076b5d4352621ec6b5fab4f0c065fe26
SSDEEP 49152:Hkwzj39pva3/Ioj15e4w8xhACEKzs57Xci5NLd:fojPJw80Rp7XcO1
TLSH
T1DDA5CF17A76801FDD0A3D2BACE524807E7B1B8460771A7DF03D09AA61F176D89E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/912-100-0x0000023FC7680000-0x0000023FC7692000-memory.dmp

Download

memory/912-101-0x0000023FC7650000-0x0000023FC765A000-memory.dmp

Download

memory/912-26-0x0000023FC75D0000-0x0000023FC75F2000-memory.dmp

Download

memory/2444-56-0x000002B0A4B10000-0x000002B0A4CF4000-memory.dmp

Download

memory/4340-58-0x00000268D14B0000-0x00000268D1694000-memory.dmp

Download