ec2b9fff9faaa5a7b0e435d4acecb0981bd16a923e5d6c75bbf37b0471730f44

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PUBG-Tool.exe
Size 1.6MB
Sample261110-xlbntaaa67
SHA256 ec2b9fff9faaa5a7b0e435d4acecb0981bd16a923e5d6c75bbf37b0471730f44
MD5 99e18afec75a329cfe27cec156cac5d7
SHA1 176a0e5963d5c60665726289583a98d004b12af9
SHA512 8dd4da47b30325d62029881c55a5a9ab01ac94de8f0dd87d7dbc60e104cb4d5e0a1ed27480424b2cca37a833ee2fe6a437782f666e70d1fa9bf52084c0f94b8a
SSDEEP 24576:4RmWLu4lAUWAlGIH1lRDWig0ZhLrcFh0lhSMXlMLjkK43FMGr:bWLuKD7ZhZBtMC
TLSH
T19C859E1AE3981076D8AF827C8995840BF6757C167320C6DF16E6C5D60F13AF8AD3E392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence

Malware Config

Signatures

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Power Settings 1 TTPs 3 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5640	powercfg.exe
3880	powercfg.exe
912	powercfg.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PUBG-Tool.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PUBG-Tool.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
5248	powershell.exe
5248	powershell.exe
5248	powershell.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
5296	powershell.exe
5296	powershell.exe
5296	powershell.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
3704	powershell.exe
3704	powershell.exe
3704	powershell.exe
6012	powershell.exe
6012	powershell.exe
6012	powershell.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe
1832	PUBG-Tool.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	PUBG-Tool.exe
Token: SeShutdownPrivilege	5640	powercfg.exe
Token: SeCreatePagefilePrivilege	5640	powercfg.exe
Token: SeShutdownPrivilege	912	powercfg.exe
Token: SeCreatePagefilePrivilege	912	powercfg.exe
Token: SeShutdownPrivilege	3880	powercfg.exe
Token: SeCreatePagefilePrivilege	3880	powercfg.exe
Token: SeDebugPrivilege	5248	powershell.exe
Token: SeIncreaseQuotaPrivilege	5248	powershell.exe
Token: SeSecurityPrivilege	5248	powershell.exe
Token: SeTakeOwnershipPrivilege	5248	powershell.exe
Token: SeLoadDriverPrivilege	5248	powershell.exe
Token: SeSystemProfilePrivilege	5248	powershell.exe
Token: SeSystemtimePrivilege	5248	powershell.exe
Token: SeProfSingleProcessPrivilege	5248	powershell.exe
Token: SeIncBasePriorityPrivilege	5248	powershell.exe
Token: SeCreatePagefilePrivilege	5248	powershell.exe
Token: SeBackupPrivilege	5248	powershell.exe
Token: SeRestorePrivilege	5248	powershell.exe
Token: SeShutdownPrivilege	5248	powershell.exe
Token: SeDebugPrivilege	5248	powershell.exe
Token: SeSystemEnvironmentPrivilege	5248	powershell.exe
Token: SeRemoteShutdownPrivilege	5248	powershell.exe
Token: SeUndockPrivilege	5248	powershell.exe
Token: SeManageVolumePrivilege	5248	powershell.exe
Token: 33	5248	powershell.exe
Token: 34	5248	powershell.exe
Token: 35	5248	powershell.exe
Token: 36	5248	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeIncreaseQuotaPrivilege	2560	powershell.exe
Token: SeSecurityPrivilege	2560	powershell.exe
Token: SeTakeOwnershipPrivilege	2560	powershell.exe
Token: SeLoadDriverPrivilege	2560	powershell.exe
Token: SeSystemProfilePrivilege	2560	powershell.exe
Token: SeSystemtimePrivilege	2560	powershell.exe
Token: SeProfSingleProcessPrivilege	2560	powershell.exe
Token: SeIncBasePriorityPrivilege	2560	powershell.exe
Token: SeCreatePagefilePrivilege	2560	powershell.exe
Token: SeBackupPrivilege	2560	powershell.exe
Token: SeRestorePrivilege	2560	powershell.exe
Token: SeShutdownPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeSystemEnvironmentPrivilege	2560	powershell.exe
Token: SeRemoteShutdownPrivilege	2560	powershell.exe
Token: SeUndockPrivilege	2560	powershell.exe
Token: SeManageVolumePrivilege	2560	powershell.exe
Token: 33	2560	powershell.exe
Token: 34	2560	powershell.exe
Token: 35	2560	powershell.exe
Token: 36	2560	powershell.exe
Token: SeDebugPrivilege	5296	powershell.exe
Token: SeIncreaseQuotaPrivilege	5296	powershell.exe
Token: SeSecurityPrivilege	5296	powershell.exe
Token: SeTakeOwnershipPrivilege	5296	powershell.exe
Token: SeLoadDriverPrivilege	5296	powershell.exe
Token: SeSystemProfilePrivilege	5296	powershell.exe
Token: SeSystemtimePrivilege	5296	powershell.exe
Token: SeProfSingleProcessPrivilege	5296	powershell.exe
Token: SeIncBasePriorityPrivilege	5296	powershell.exe
Token: SeCreatePagefilePrivilege	5296	powershell.exe
Token: SeBackupPrivilege	5296	powershell.exe
Token: SeRestorePrivilege	5296	powershell.exe
Token: SeShutdownPrivilege	5296	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1832	PUBG-Tool.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1832	PUBG-Tool.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 5956	1832	PUBG-Tool.exe	89
PID 1832 wrote to memory of 5640	1832	PUBG-Tool.exe	92
PID 1832 wrote to memory of 912	1832	PUBG-Tool.exe	94
PID 1832 wrote to memory of 3880	1832	PUBG-Tool.exe	96
PID 1832 wrote to memory of 5260	1832	PUBG-Tool.exe	98
PID 1832 wrote to memory of 5248	1832	PUBG-Tool.exe	100
PID 1832 wrote to memory of 2560	1832	PUBG-Tool.exe	104
PID 1832 wrote to memory of 5296	1832	PUBG-Tool.exe	106
PID 1832 wrote to memory of 3704	1832	PUBG-Tool.exe	108
PID 1832 wrote to memory of 6012	1832	PUBG-Tool.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PUBG-Tool.exe
"C:\Users\Admin\AppData\Local\Temp\PUBG-Tool.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "PUBG Tool (FLOKI)"
  2⤵
  PID:5956
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5640
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Windows\system32\powercfg.exe
  "C:\Windows\system32\powercfg.exe" /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\system32\schtasks.exe
  "C:\Windows\system32\schtasks.exe" /Query /TN "PUBG Tool (FLOKI)"
  2⤵
  PID:5260
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5248
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoAJABrACAAPQAgAEAAKAAnACoARQBFAEUAJwAsACcARQBFAEUAJwAsACcAQQBkAHYAYQBuAGMAZQBkAEUARQBFACcALAAnAEUAbgBhAGIAbABlAEcAcgBlAGUAbgBFAHQAaABlAHIAbgBlAHQAJwAsACcAUABvAHcAZQByAFMAYQB2AGkAbgBnAE0AbwBkAGUAJwAsACcARwBpAGcAYQBMAGkAdABlACcALAAnACoAUwBlAGwAZQBjAHQAaQB2AGUAUwB1AHMAcABlAG4AZAAnACkAOwBHAGUAdAAtAE4AZQB0AEEAZABhAHAAdABlAHIAQQBkAHYAYQBuAGMAZQBkAFAAcgBvAHAAZQByAHQAeQAgAC0ATgBhAG0AZQAgACcARQB0AGgAZQByAG4AZQB0ACcAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACAAJABrACAALQBjAG8AbgB0AGEAaQBuAHMAIAAkAF8ALgBSAGUAZwBpAHMAdAByAHkASwBlAHkAdwBvAHIAZAAgAC0AYQBuAGQAIABbAHMAdAByAGkAbgBnAF0AJABfAC4AUgBlAGcAaQBzAHQAcgB5AFYAYQBsAHUAZQAgAC0AbgBlACAAJwAwACcAIAB9ACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AJwAgAC0AZgAgACQAXwAuAFIAZQBnAGkAcwB0AHIAeQBLAGUAeQB3AG8AcgBkACwAIAAoAFsAcwB0AHIAaQBuAGcAXQAkAF8ALgBSAGUAZwBpAHMAdAByAHkAVgBhAGwAdQBlACkAIAB9AAoAfQAgAGMAYQB0AGMAaAAgAHsAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoARQByAHIAbwByAC4AVwByAGkAdABlAEwAaQBuAGUAKAAkAF8ALgBFAHgAYwBlAHAAdABpAG8AbgAuAE0AZQBzAHMAYQBnAGUAKQA7ACAAZQB4AGkAdAAgADEAIAB9AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5296
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3704
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwB0AG8AcAAnADsAWwBDAG8AbgBzAG8AbABlAF0AOgA6AE8AdQB0AHAAdQB0AEUAbgBjAG8AZABpAG4AZwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4ADsAdAByAHkAIAB7AAoARwBlAHQALQBOAGUAdABBAGQAYQBwAHQAZQByACAALQBJAG4AYwBsAHUAZABlAEgAaQBkAGQAZQBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlACAAfAAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIAAnAHsAMAB9AHwAewAxAH0AfAB7ADIAfQB8AHsAMwB9AHwAewA0AH0AfAB7ADUAfQB8AHsANgB9ACcAIAAtAGYAIAAkAF8ALgBOAGEAbQBlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBHAHUAaQBkACwAIAAkAF8ALgBTAHQAYQB0AHUAcwAsACAAJABfAC4AUABoAHkAcwBpAGMAYQBsAE0AZQBkAGkAYQBUAHkAcABlACwAIAAkAF8ALgBJAG4AdABlAHIAZgBhAGMAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4ALAAgACQAXwAuAGkAZgBJAG4AZABlAHgALAAgACQAXwAuAEgAYQByAGQAdwBhAHIAZQBJAG4AdABlAHIAZgBhAGMAZQAgAH0ACgB9ACAAYwBhAHQAYwBoACAAewAgAFsAQwBvAG4AcwBvAGwAZQBdADoAOgBFAHIAcgBvAHIALgBXAHIAaQB0AGUATABpAG4AZQAoACQAXwAuAEUAeABjAGUAcAB0AGkAbwBuAC4ATQBlAHMAcwBhAGcAZQApADsAIABlAHgAaQB0ACAAMQAgAH0A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.xml

Path C:\ProgramData\PUBG-Tool\settings.xml
Size 1KB
SHA256 bda22d29d82e583e621f42d82c269f7ffb977ed2d893454645489f3714fc723e
MD5 ef3ac3531083c5a1a47b47d598e3053c
SHA1 30deaa588a3b365ae820bfd2802a556ba5d268d9
SHA512 b165a40d8285daf63345a279ee1914e2d8bae127722c1a4132b10ff6ad5424294d6dc1384a0e7ee54488a61d90aa0ff5a970c9385d6c04c0a248732c49cc68ae
TLSH
T1B311E220E9C0616AA5B340A8BE19EF05F902D6E293464ED4FBED8B0727509583683B31
MD5 SHA1 SHA512 TLSH

Submit Download

settings.xml.tmp

Path C:\ProgramData\PUBG-Tool\settings.xml.tmp
Size 1KB
SHA256 d643cb6ea6615a683d38b380d9902a1244e74b48224e5bedc63fd4083b77c573
MD5 5c9dec9b6112f8a06d3640fb335c8682
SHA1 0cbc0bd5b566c339e6ee66ac79b2fc0970428c37
SHA512 ec92f90931b42a3bdf2ef81de502d3e1b1da68da4e1eb52c20234adeda970087300f03b3d8ffa4732921ac128c3680cf3016894b1d6d4a82729319f434783755
TLSH
T12B211220F9C0616A99B240A8BA19DF05F502EAE283464ED8FBFD8B0727519543A83B31
MD5 SHA1 SHA512 TLSH

Submit Download

trial.txt

Path C:\ProgramData\PUBG-Tool\trial.txt
Size 109B
SHA256 5b22e221769e449e2599628c5cb498c891344101920d25cab70638d2e0281346
MD5 5dec25a9293637244dffff9c6e97759d
SHA1 3e97e698e3a6d11b239da2e191ef767e399b6c1c
SHA512 e2c7967b8d879ab8da376f831f0f173c98ed000b41047b40c07834957ac01e486e67ece9e84cadbdba45118de6e99bbfe9249a9ac4f7096140c63a6f4a78688b
TLSH
T1B4B0220A3C800020E8A2B0080A3C0CC0F0C22023F00E208CB20C88C80ECB23C2B32B0E
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 de5226bb90447b020b113278baa7a41597f391ec435c5a5471304a4bbab90453
MD5 e5b4d80c992ec47d3ea668484e9a28e2
SHA1 ff67eed419b1bf8d14be206efe33c6f3ddda8005
SHA512 0970da1c8dd84455b55d4c4b986bbf7f8cc410af0f7257f5ff68a9019668e8e6332bff6d60419159e786be6f6d1eb84581fcf78cdd1778019f415682640e530f
TLSH
T1AB219833B3CC8624C89A003A10CDAC0036B6CBDB40DECE5B6B80E655A43F698CE60060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c88ebecf1cd20b584dc9e97f11a9d1001b13ecbb5d612db254d0b636a2382ef7
MD5 85c23b99ad2d1ef37d64864dde7ff5e9
SHA1 0d1857abbca5dcb70f2f965459fbc6438d485d24
SHA512 57301e971074f3e283f1b57f77162aeebae96d3755ae63cc36ee6a86cbf8f4ce0454967b6e69a2e8efe3a09209043f7e8bef8a467086c2a1e7ba1fc335e03ff1
TLSH
T146216837B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1201ada9440e9e29168e875821467b0f1717a4a2676f0ca4b550af1a61bbeeaf
MD5 7903d68c8c7063c492259e033626508b
SHA1 8ed67b0a9c5eb84ffb3d4f1efa723b0e8708aae4
SHA512 634f4124eade2ee7ada689163b9f4200ea506dc2305df9a9a456a57b20828145c74db17449675854436363088c7faf7b5ff685a9f58dea8774bdb88fe181da9c
TLSH
T173216833B3DD8624C89A413A10CEAC1036B6C7DB41DECFAB6B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_nkduilnp.hz3.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nkduilnp.hz3.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1832-29-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-56-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-12-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-10-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-22-0x000002307E980000-0x000002307E98E000-memory.dmp

Download

memory/1832-21-0x000002307E9C0000-0x000002307E9FE000-memory.dmp

Download

memory/1832-20-0x000002307E970000-0x000002307E978000-memory.dmp

Download

memory/1832-28-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-0-0x00007FFF15F2F000-0x00007FFF15F30000-memory.dmp

Download

memory/1832-9-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-7-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-1-0x0000023063360000-0x0000023063506000-memory.dmp

Download

memory/1832-72-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-70-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-5-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-2-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-63-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-4-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-55-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-11-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/1832-3-0x00007FFF15DA0000-0x00007FFF16744000-memory.dmp

Download

memory/5248-48-0x000001AE1D540000-0x000001AE1D55E000-memory.dmp

Download

memory/5248-47-0x000001AE1D510000-0x000001AE1D51A000-memory.dmp

Download

memory/5248-46-0x000001AE1D450000-0x000001AE1D502000-memory.dmp

Download

memory/5248-45-0x000001AE1D430000-0x000001AE1D44E000-memory.dmp

Download

memory/5248-42-0x000001AE04E10000-0x000001AE04E32000-memory.dmp

Download