ec2b9fff9faaa5a7b0e435d4acecb0981bd16a923e5d6c75bbf37b0471730f44

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PUBG-Tool.exe
Size 1.6MB
Sample261110-xlbntaaa67
SHA256 ec2b9fff9faaa5a7b0e435d4acecb0981bd16a923e5d6c75bbf37b0471730f44
MD5 99e18afec75a329cfe27cec156cac5d7
SHA1 176a0e5963d5c60665726289583a98d004b12af9
SHA512 8dd4da47b30325d62029881c55a5a9ab01ac94de8f0dd87d7dbc60e104cb4d5e0a1ed27480424b2cca37a833ee2fe6a437782f666e70d1fa9bf52084c0f94b8a
SSDEEP 24576:4RmWLu4lAUWAlGIH1lRDWig0ZhLrcFh0lhSMXlMLjkK43FMGr:bWLuKD7ZhZBtMC
TLSH
T19C859E1AE3981076D8AF827C8995840BF6757C167320C6DF16E6C5D60F13AF8AD3E392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 3 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2768	powercfg.exe
4680	powercfg.exe
4824	powercfg.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PUBG-Tool.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PUBG-Tool.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
4932	powershell.exe
4932	powershell.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
544	powershell.exe
544	powershell.exe
2560	powershell.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
2560	powershell.exe
3376	powershell.exe
3376	powershell.exe
936	powershell.exe
936	powershell.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe
1288	PUBG-Tool.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1288	PUBG-Tool.exe
Token: SeShutdownPrivilege	2768	powercfg.exe
Token: SeCreatePagefilePrivilege	2768	powercfg.exe
Token: SeShutdownPrivilege	4680	powercfg.exe
Token: SeCreatePagefilePrivilege	4680	powercfg.exe
Token: SeShutdownPrivilege	4824	powercfg.exe
Token: SeCreatePagefilePrivilege	4824	powercfg.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeIncreaseQuotaPrivilege	4932	powershell.exe
Token: SeSecurityPrivilege	4932	powershell.exe
Token: SeTakeOwnershipPrivilege	4932	powershell.exe
Token: SeLoadDriverPrivilege	4932	powershell.exe
Token: SeSystemProfilePrivilege	4932	powershell.exe
Token: SeSystemtimePrivilege	4932	powershell.exe
Token: SeProfSingleProcessPrivilege	4932	powershell.exe
Token: SeIncBasePriorityPrivilege	4932	powershell.exe
Token: SeCreatePagefilePrivilege	4932	powershell.exe
Token: SeBackupPrivilege	4932	powershell.exe
Token: SeRestorePrivilege	4932	powershell.exe
Token: SeShutdownPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeSystemEnvironmentPrivilege	4932	powershell.exe
Token: SeRemoteShutdownPrivilege	4932	powershell.exe
Token: SeUndockPrivilege	4932	powershell.exe
Token: SeManageVolumePrivilege	4932	powershell.exe
Token: 33	4932	powershell.exe
Token: 34	4932	powershell.exe
Token: 35	4932	powershell.exe
Token: 36	4932	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeIncreaseQuotaPrivilege	544	powershell.exe
Token: SeSecurityPrivilege	544	powershell.exe
Token: SeTakeOwnershipPrivilege	544	powershell.exe
Token: SeLoadDriverPrivilege	544	powershell.exe
Token: SeSystemProfilePrivilege	544	powershell.exe
Token: SeSystemtimePrivilege	544	powershell.exe
Token: SeProfSingleProcessPrivilege	544	powershell.exe
Token: SeIncBasePriorityPrivilege	544	powershell.exe
Token: SeCreatePagefilePrivilege	544	powershell.exe
Token: SeBackupPrivilege	544	powershell.exe
Token: SeRestorePrivilege	544	powershell.exe
Token: SeShutdownPrivilege	544	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeSystemEnvironmentPrivilege	544	powershell.exe
Token: SeRemoteShutdownPrivilege	544	powershell.exe
Token: SeUndockPrivilege	544	powershell.exe
Token: SeManageVolumePrivilege	544	powershell.exe
Token: 33	544	powershell.exe
Token: 34	544	powershell.exe
Token: 35	544	powershell.exe
Token: 36	544	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeIncreaseQuotaPrivilege	2560	powershell.exe
Token: SeSecurityPrivilege	2560	powershell.exe
Token: SeTakeOwnershipPrivilege	2560	powershell.exe
Token: SeLoadDriverPrivilege	2560	powershell.exe
Token: SeSystemProfilePrivilege	2560	powershell.exe
Token: SeSystemtimePrivilege	2560	powershell.exe
Token: SeProfSingleProcessPrivilege	2560	powershell.exe
Token: SeIncBasePriorityPrivilege	2560	powershell.exe
Token: SeCreatePagefilePrivilege	2560	powershell.exe
Token: SeBackupPrivilege	2560	powershell.exe
Token: SeRestorePrivilege	2560	powershell.exe
Token: SeShutdownPrivilege	2560	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	PUBG-Tool.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1288	PUBG-Tool.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 4164	1288	PUBG-Tool.exe	84
PID 1288 wrote to memory of 2768	1288	PUBG-Tool.exe	88
PID 1288 wrote to memory of 4680	1288	PUBG-Tool.exe	90
PID 1288 wrote to memory of 4824	1288	PUBG-Tool.exe	92
PID 1288 wrote to memory of 1176	1288	PUBG-Tool.exe	94
PID 1288 wrote to memory of 4932	1288	PUBG-Tool.exe	96
PID 1288 wrote to memory of 544	1288	PUBG-Tool.exe	103
PID 1288 wrote to memory of 2560	1288	PUBG-Tool.exe	105
PID 1288 wrote to memory of 3376	1288	PUBG-Tool.exe	107
PID 1288 wrote to memory of 936	1288	PUBG-Tool.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PUBG-Tool.exe
"C:\Users\Admin\AppData\Local\Temp\PUBG-Tool.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "PUBG Tool (FLOKI)"
  2⤵
  PID:4164
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4680
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4824
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "PUBG Tool (FLOKI)"
  2⤵
  PID:1176
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4932
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoAJABrACAAPQAgAEAAKAAnACoARQBFAEUAJwAsACcARQBFAEUAJwAsACcAQQBkAHYAYQBuAGMAZQBkAEUARQBFACcALAAnAEUAbgBhAGIAbABlAEcAcgBlAGUAbgBFAHQAaABlAHIAbgBlAHQAJwAsACcAUABvAHcAZQByAFMAYQB2AGkAbgBnAE0AbwBkAGUAJwAsACcARwBpAGcAYQBMAGkAdABlACcALAAnACoAUwBlAGwAZQBjAHQAaQB2AGUAUwB1AHMAcABlAG4AZAAnACkAOwBHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAQQBkAHYAYQBuAGMAZQBkAFAAcgBvAHAAZQByAHQAeQAgAC0ATgBhAG0AZQAgACcARQB0AGgAZQByAG4AZQB0ACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABrACAALQBjAG8AbgB0AGEAaQBuAHMAIAAkAF8ALgBSAGUAZwBpAHMAdAByAHkASwBlAHkAdwBvAHIAZAAgAC0AYQBuAGQAIABbAHMAdAByAGkAbgBnAF0AJABfAC4AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAC0AbgBlACAAJwAwACcAIAB9ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AJwAgAC0AZgAgACQAXwAuAFIAZQBnAGkAcwB0AHIAeQBLAGUAeQB3AG8AcgBkACwAIAAoAFsAcwB0AHIAaQBuAGcAXQAkAF8ALgBSAGUAZwBpAHMAdAByAHkAVgBhAGwAdQBlACkAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoARQByAHIAbwByAC4AVwByAGkAdABlAEwAaQBuAGUAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQA7ACAAZQB4AGkAdAAgADEAIAB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

trial.txt

Path C:\ProgramData\PUBG-Tool\trial.txt
Size 109B
SHA256 f2e29d916f8de8cb88f93dc73f058cf3cd57859aeb3717f5c31adef9d66b0e0c
MD5 51365847f66366680d3070b2b9931303
SHA1 87ee248333a1ac902e788338d1141fa1c81cd34c
SHA512 f733d387075a7665c76180314010da5099c99c9b8574b4f467566419b72cddca42fe7f3db1141b30d94e419ad1a804eb4866b55a8818ab356778a3117fb71c48
TLSH
T18CB012455B3176421DF281C6A96F8D20F30DBD02441D24FCE214819C1A902137CCB8DF
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bdf68c8834dbe5b154be468c5c3b9773fb5d2d872a29ecad805ba7d0bccf364c
MD5 28666de236927fe81bf20371c32399e2
SHA1 40348c629e17f3fb4629cd6708f87f9cda2483ce
SHA512 6203ed0fb51013b78f7ca0e1c5dd7507e5abd2404cd54def6e00734c5185c4281b08215a027a111e0d3ced220ecf0bbf6b0d421d5d4a80885d3d79a6fecdb7e9
TLSH
T1D8217423B38D8820CC9A163A509C9C5172A686CB81DECF9F6EC0C21191BFAC8CB21194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ebebd927a139806274b048d5407d623749084dad08813afb04fe2c74ff4dc84e
MD5 58592c9847ccce1e56b2d1ba29b61cb8
SHA1 c3ce63233a28eeabec8e9d0c5103f545f7148bd0
SHA512 ac7c17685c9e8cb6b5b572bed1f782536174a2bd069fdeae257c1c93b2bc3da7d3f19487ac81055739bd912f5d1247284d4a0bb0734f209e90d288f9b7daa706
TLSH
T18D217423B38D8820CCEA163A109C9C5172A686CB81DFDF9F2EC0C21191BFAC8CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2735c36eb4646feaf972bebd02779727a8ca66de4389477297ace0976b143349
MD5 1b43a808284da8d61503dd6c6c863794
SHA1 f269c29d64fda3ea16d08a9a5edb7f613c83ad37
SHA512 17204e5295be8d6a76e615cf3631c183b0bba392aff1dc11149e2521bd87e07fe50f67efb6d1d16c44034eb62c947f6c67cfc7b2877221ef7f0789be69760104
TLSH
T1E8217423B39D8820CC9A163A109C9C5172A686CB81DFCF9F2EC0C21191BFAC9CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2e1d2b0a86abe46d40843dbc522f6c9891671b21c1ac61e21d32f7245a93eb8b
MD5 c8c29f1f588816cb69fcebf642891720
SHA1 968d91f771b5e235c91952025509479c4456b44e
SHA512 6b19696757654762ec551388c04142d4404892314c3e8a811b3260834dd6110b57be9aa4a0497ff579a4936c91cbdfbf7a938f676ee24e7476ecdd1b668cac3a
TLSH
T1E6217423B39D8820CC9A163A109C9C5172A686CB80DECF9F2EC0C21195BFAC9CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_135f02ns.rm1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_135f02ns.rm1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1288-12-0x00000174D3380000-0x00000174D3388000-memory.dmp

Download

memory/1288-20-0x00000174D33C0000-0x00000174D33D0000-memory.dmp

Download

memory/1288-14-0x00000174D3390000-0x00000174D339E000-memory.dmp

Download

memory/1288-13-0x00000174D3AB0000-0x00000174D3AE8000-memory.dmp

Download

memory/1288-0-0x00000174B7480000-0x00000174B7626000-memory.dmp

Download

memory/1288-3-0x00000174D33C0000-0x00000174D33D0000-memory.dmp

Download

memory/1288-61-0x00000174D33C0000-0x00000174D33D0000-memory.dmp

Download

memory/1288-1-0x00000174D33C0000-0x00000174D33D0000-memory.dmp

Download

memory/1288-72-0x00000174D33C0000-0x00000174D33D0000-memory.dmp

Download

memory/4932-29-0x000001AA56580000-0x000001AA565A2000-memory.dmp

Download